Bid Beasts
First Flight #49
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Failed Credits Withdrawal Updates Wrong Mapping Key

doniabs

Root + Impact

Description

  • Normal behavior: users who have pending faled ETH transfers in failedTransferCredits should be able to withdraw their funds using withdrawFailedCredits().

  • Specific issue: the function mistakenly zeros failedTransferCreadits[msg.sender] instead of failedTransferCreadits[_receiver]. this prevents the correct balance from being cleared.

uint256 amount = failedTransferCredits[_receiver];
require(amount > 0, "No credits to withdraw");
@> failedTransferCredits[msg.sender] = 0;
(bool success, ) = payable(msg.sender).call{value: amount}("");
require(success, "Withdraw failed");

Risk

Likelihood:

  • every time a user calls withdrawAllFailedCredits() for another address, the intended _receiver's balance remains in the mapping

  • any failed transfers that rely on this mapping will be inconsistently recorded, potentially allowing repeated withdraws.

Impact:

  • users may lose funds or have credits remain uncleared.

  • could be exploited to mislead users about available balances or lock ETH in the contract.

Proof of Concept

Step 1: Alice has 2 ETH pending in failedTransferCredits[Alice].
Step 2: Bob calls withdrawAllFailedCredits(Alice).
Step 3: The contract mistakenly zeros failedTransferCredits[Bob] instead of Alice.
Step 4: Alice’s funds remain in the contract and cannot be withdrawn.
​
// Assume Alice has 2 ETH in failedTransferCredits[Alice]
failedTransferCredits[Alice] = 2 ether;
​
// Bob calls withdrawAllFailedCredits(Alice)
contract.withdrawAllFailedCredits(Alice, {from: Bob});
​
// Check balances
console.log(failedTransferCredits[Alice]); // Still 2 ETH
console.log(failedTransferCredits[Bob]); // 0 ETH (was set incorrectly)

Recommended Mitigation

- failedTransferCredits[msg.sender] = 0;
+ failedTransferCredits[msg.sender] = 0;
​
Change `failedTransferCredits[msg.sender] = 0;` to `failedTransferCredits[_receiver] = 0;`.
This ensures that the correct user’s balance is cleared when withdrawing failed credits, preventing lost or stuck funds.
​
Updates

Lead Judging Commences

cryptoghost Lead Judge 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BidBeast Marketplace: Unrestricted FailedCredits Withdrawal

withdrawAllFailedCredits allows any user to withdraw another account’s failed transfer credits due to improper use of msg.sender instead of _receiver for balance reset and transfer.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!