RebateFi Hook
First Flight #53
Beginner FriendlyDeFi
100 EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: medium
Invalid

Insufficient Edge Case Handling in Withdrawal Logic

sulfurpt

Description

  • The `withdrawTokens` function lacks comprehensive validation for edge cases, potentially leading to unnecessary gas costs, confusing event emissions, and integration issues with non-standard token behaviors.

function withdrawTokens(address token, address to, uint256 amount) external onlyOwner {
@> IERC20(token).transfer(to, amount); // Minimal validation
emit TokensWithdrawn(to, token, amount);
}

Risk

Impact:

  • Zero-amount withdrawals waste gas;

  • Unnecessary event emissions for zero-value operations;

  • Self-withdrawals create misleading event parameters;

  • May fail silently if token doesn't implement ERC20 properly.

Proof of Concept

Add the following to `RebateFiHookTest.t.sol`

function test_WithdrawZeroAmount() public {
reFiToken.mint(address(rebateHook), 100 ether);
rebateHook.withdrawTokens(address(reFiToken), address(this), 0);
assertEq(reFiToken.balanceOf(address(rebateHook)), 100 ether);
}

And/Or

function test_WithdrawMoreThanBalance() public {
reFiToken.mint(address(rebateHook), 100 ether);
vm.expectRevert(); // ERC20 transfer reverts on insufficient balance
rebateHook.withdrawTokens(address(reFiToken), address(this), 200 ether);
}

Recommended Mitigation

function withdrawTokens(address token, address to, uint256 amount) external onlyOwner {
+ require(amount > 0, "Cannot withdraw zero amount");
IERC20(token).transfer(to, amount);
emit TokensWithdrawn(to, token , amount);
}

Also:

  • Add maximum withdrawal limits to prevent accidental large transfers

  • Implement withdrawal batching for multiple tokens

  • Consider adding emergency withdrawal patterns with multisig requirements

  • Add token blacklisting for problematic tokens

Updates

Lead Judging Commences

chaossr Lead Judge
13 days ago
chaossr Lead Judge 12 days ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!