Beatland Festival
AI First Flight #4
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Impact: medium
Likelihood: medium
Invalid

[M-2] `withdraw` uses `transfer()` which may fail for smart contract recipients

quangviet910

Root + Impact

Description

  • The withdraw function uses Solidity's .transfer() method which forwards only 2300 gas.

  • This is insufficient for smart contract wallets (multisigs, Gnosis Safe) that require more gas in their receive/fallback functions.

function withdraw(address target) external onlyOwner {
payable(target).transfer(address(this).balance);
}

Risk

Likelihood:

  • Owner sets a multisig or smart contract as the withdrawal target

  • Many DAOs and protocols use multisig wallets

Impact:

  • ETH from pass sales permanently locked in the contract

  • No fallback mechanism to recover funds

Proof of Concept

Below PoC demonstrates that a receiver needing a lot of gas in the receive() cannot withdraw the fund.

contract RejectingReceiver {
receive() external payable {
uint256 tmp;
for (uint256 i=0; i<1000; i++) {
tmp += i * i;
}
}
}
​
function test_WithdrawFailsForSmartContract() public {
vm.deal(user, 0.05 ether);
vm.prank(organizer);
festivalPass.configurePass(1, 0.05 ether, 100);
vm.prank(user);
festivalPass.buyPass{value: 0.05 ether}(1);
​
RejectingReceiver rejecter = new RejectingReceiver();
vm.expectRevert();
festivalPass.withdraw(address(rejecter));
​
// Funds still locked
assertEq(address(festivalPass).balance, 0.05 ether);
}

Recommended Mitigation

Use low-level `.call{}` with success check and emit event to inform relevant party about the successful withdraw

function withdraw(address target) external onlyOwner {
- payable(target).transfer(address(this).balance);
+ (bool success, ) = payable(target).call{value: address(this).balance}("");
+ require(success, "Transfer failed");
+ emit FundsWithdrawn(target, address(this).balance);
}
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge 11 days ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!