Bid Beasts

The function withdrawAllFailedCredits(address _receiver) lets anyone call it and pass in any address as _receiver. It then reads the credit stored for _receiver, but resets the balance for msg.sender and transfers the _receiver’s amount to msg.sender.

This means a malicious user can drain ETH stored for other users.

Issue:

function withdrawAllFailedCredits(address _receiver) external

{

`     uint256 amount = failedTransferCredits[_receiver];  ` 

`     require(amount > 0, "No credits to withdraw");  ` 

`     failedTransferCredits[msg.sender] = 0;  ` 

`     (bool success, ) = payable(msg.sender).call{value: amount}("");  ` 

`     require(success, "Withdraw failed");   `  

}

Fix:
Restrict withdrawals so that only the credited address can withdraw its own funds.


function withdrawFailedCredits() external {
uint256 amount = failedTransferCredits[msg.sender];
require(amount > 0, "No credits to withdraw");

  `failedTransferCredits[msg.sender] = 0;`

(bool success, ) = payable(msg.sender).call{value: amount}("");````require(success, "Withdraw failed");

}