Description:

The withdrawAllFailedCredits() function contains a critical vulnerability where it reads the balance of one user (_receiver) (parameter is controled by attacker) but resets the balance of another user (msg.sender) and sends funds to msg.sender. This creates a severe vulnerability where any user can drain all ETH from the contract by specifying other users' addresses as the _receiver parameter while receiving the funds themselves.

Attack path:

1. Attacker calls withdrawAllFailedCredits(victimAddress) where victimAddress has accumulated failed ETH

2. The function reads amount = failedTransferCredits[victimAddress] (victim's balance)

3. The function incorrectly resets failedTransferCredits[msg.sender] = 0 (attacker's balance, not victim's)

4. The function sends amount ETH to payable(msg.sender) (attacker receives funds)

5. Victim's balance failedTransferCredits[victimAddress] remains unchanged

6. Attacker can repeat this process indefinitely to drain all ETH from the contract

Impact:

Complete theft of the entire contract balance (failed transfer ETH + fees)

Recommended Mitigation:

Fix the function that msg.sender can set different receiver address, if msg.sender could not receive ETH