Root + Impact

Description

The RaiseBoxFaucet contract, which has functionality to receive and distribute Sepolia ETH, lacks admin functionality to withdraw Sepolia ETH in case of an emergency that would require redeploying the contract and refunding the new contract.

Risk

Likelihood:

• Any emergency or denial of service (DoS) that might require contract redeployment and funds migration.

Impact:

• Loss of funds in case of an emergency that would require redeploying the contract and refunding the new contract.

Proof of Concept

A possible cause for an emergency is another finding where the faucetDrip value, incorrectly set during deployment, breaks the contract's functionality.

Recommended Mitigation

Consider adding a RaiseBoxFaucet::withdrawNativeFunds function to allow the owner to withdraw or transfer Sepolia ETH in case of an emergency.