BalancerMaxis / ChildGaugeInjectorV2

1 stars 0 forks source link

Low risk (L3): `withdrawGasToken` signals gas token will be in the contract, but no `receive()` method is present #29

Open petrovska-petro opened 6 days ago

petrovska-petro commented 6 days ago

Severity: if ether is sent without defining the receive() method in the smart contract, it will throw an exception

Context: the method withdrawGasToken suggests that gas balance will be in the contract, but no proper way to received actual gas in the contract

uint256 amount = address(this).balance;
recipient.transfer(amount);

Recommendation: see documentation and add at least a receive() method if intention is to receive gas tokens into the injector.

Review stage

Balancer Maxis:

Onchainification Labs:

Tritium-VLK commented 3 days ago

It is not intended for the injector to hold gas tokens. I guess then could just remove this function. This is just kind of the baseline of what I have used as a admin owned, fully controlled, max flexibillity helper.

petrovska-petro commented 2 days ago

Then, indeed makes sense to remove withdrawGasToken from the contract