Beatland Festival
AI First Flight #4
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Impact: medium
Likelihood: high
Invalid

withdrawing ETH doesn't work as intended as in the natspec

notaltera

FestivalPass::withdraw function were only callable by the owner of the contract, The organizer cannot call this function as stated in the natspec

Description

FestivalPass::withdraw function hold a natspec that states "Organizer withdraws ETH" This means that the withdraw function were supposed to be used to withdraw ETH tot he Organizer's addresses

But, the function can only be called by the owner of the contract, the organizer had no power whatsoever to withraw the ETH

@> // Organizer withdraws ETH
function withdraw(address target) external onlyOwner {
payable(target).transfer(address(this).balance);
}

Risk

Likelihood:

Occurs everytime when owner transfer the ETH however the owners like.

Impact:

Organizer do not have any control whatsoever on where the ETH is going.

Proof of Concept

Copy the following code into test/FestivalPass.t.sol test suite

function testOrganizerCannotWithdraw() public {
vm.prank(user1);
festivalPass.buyPass{value: GENERAL_PRICE}(1);
​
uint256 contractBalance = address(festivalPass).balance;
uint256 targetBalanceBefore = organizer.balance;
​
vm.startPrank(organizer);
vm.expectRevert();
festivalPass.withdraw(organizer);
vm.stopPrank();
​
assertEq(address(festivalPass).balance, GENERAL_PRICE);
assertEq(organizer.balance, 0);
}

Recommended Mitigation

The natspec of the function intended that the Organizer witdraw the ETH, so we need to change the onlyOwner modifier into onlyOrganizer modifier

// Organizer withdraws ETH
- function withdraw(address target) external onlyOwner {
+ function withdraw(address target) external onlyOrganizer {
payable(target).transfer(address(this).balance);
}
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge 1 day ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!