SNARKeling Treasure Hunt
First Flight #59
Beginner FriendlyGameFiFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

[L-03] `receive()` bypasses owner-only funding policy enforced by `fund()`

adcdiii

Root + Impact

Description

The contract exposes fund() with owner-only access checks, which implies a controlled funding path.

The issue is that receive() accepts ETH from any sender without access control. This bypasses the owner-only funding rule and creates inconsistent behavior between two funding entry points.

// contracts/src/TreasureHunt.sol
function fund() external payable {
require(msg.sender==owner, "ONLY_OWNER_CAN_FUND");
require(msg.value > 0, "NO_ETH_SENT");
emit Funded(msg.value, address(this).balance);
}
​
receive() external payable {
emit Funded(msg.value, address(this).balance); // @> accepts ETH from anyone
}

Risk

Likelihood:

  • Any address can transfer ETH directly to contract.

  • Existing test confirms non-owner funding via receive() succeeds.

Impact:

  • Access-control model for funding becomes inconsistent.

  • Off-chain accounting and operational assumptions about trusted funding source can be incorrect.

Proof of Concept

Written reproduction flow:

  1. Keep owner-only fund() policy unchanged.

  2. Send ETH directly from non-owner to contract address.

  3. Observe transfer succeeds and Funded emits.

function test_B3_ReceiveFromNonOwner() public {
uint256 balBefore = address(hunt).balance;
​
vm.prank(ATTACKER);
(bool sent,) = address(hunt).call{value: 1 ether}("");
​
assertTrue(sent);
assertEq(address(hunt).balance, balBefore + 1 ether);
}

Recommended Mitigation

Use either function receive() or function fund() consistently with one policy.

receive() external payable {
+ require(msg.sender == owner, "ONLY_OWNER_CAN_FUND");
emit Funded(msg.value, address(this).balance);
}

Or remove owner restriction from fund() and document permissionless funding explicitly.

Updates

Lead Judging Commences

s3mvl4d Lead Judge 18 days ago
Submission Judgement Published
Validated
Assigned finding tags:

nonowner can fund

Although the explicit `fund()` function is restricted to the owner via `require(msg.sender == owner, "ONLY_OWNER_CAN_FUND")`, the contract also implements a permissive `receive()` function that accepts arbitrary ETH sent directly to the contract and emits the same Funded event without any sender check. This means a non-owner cannot use the `fund()` entrypoint itself, but can still increase the contract balance simply by transferring ETH to the contract address. This is an access-control inconsistency between the documented admin funding path and the actual fallback behavior.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!