RebateFi Hook
First Flight #53
Beginner FriendlyDeFi
100 EXP
View results
Previous Next
Submission Details
Impact: medium
Likelihood: low
Invalid

Missing support for native ETH withdrawals (if intended) Root + Impact

smartshielder

Root + Impact

Description

  • Normal behavior: Contracts that may receive native ETH should include a mechanism to withdraw ETH (or explicitly prohibit/avoid receiving ETH).

Problem: withdrawTokens only handles ERC20 transfers, and the contract lacks withdrawETH/receive fallback handling; any ETH sent to the contract becomes non-recoverable.

// Root cause in the codebase with @> marks to highlight the relevant section
function withdrawTokens(address token, address to, uint256 amount) external onlyOwner {
@> IERC20(token).transfer(to, amount);
emit TokensWithdrawn(token, to, amount);
}
// no withdrawETH or receive() handler present
​

Risk

Likelihood:

  • Occurs if ETH is accidentally sent to the contract (mistaken transfer), or via selfdestruct of another contract, or if future code becomes payable.

If the contract never holds ETH, the likelihood is low.

Impact:

  • ETH deposited into the contract would be permanently locked without an ETH withdrawal path.

Value loss for owner or users who mistakenly send ETH.

Proof of Concept

// Any account can send ETH:
address(hookContract).call{value: 1 ether}("");
// No method exists to withdraw the ETH, so it's locked on chain.

Recommended Mitigation

If the contract may receive ETH, implement ETH withdrawal and an optional receive handler:

+ // allow receiving ETH
+ receive() external payable {}
+
+ // owner-only ETH withdraw
+ function withdrawETH(address payable to, uint256 amount) external onlyOwner {
+ require(address(this).balance >= amount, "insufficient ETH");
+ (bool sent,) = to.call{value: amount}("");
+ require(sent, "ETH transfer failed");
+ }
​

If contract must never receive ETH, add revert in receive() to prevent accidental deposits:

+ receive() external payable {
+ revert("contract does not accept ETH");
+ }
​
Updates

Lead Judging Commences

chaossr Lead Judge
15 days ago
chaossr Lead Judge 12 days ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!