code-423n4 / 2022-06-infinity-findings

4 stars 0 forks source link

Upgraded Q -> H from 187 [1657760940788] #367

Closed code423n4 closed 2 years ago

code423n4 commented 2 years ago

Judge has assessed an item in Issue #187 as High risk. The relevant finding follows:

1. rescueETH() cannot rescue Ether

rescueETH() sends msg.value to the destination address, which means it requires the caller of rescueETH() to provide the Ether to send. Essentially the owner is directly paying the destination address, and the Ether in the contract remains untouched

There is 1 instance of this issue:

File: contracts/staking/InfinityStaker.sol   #1

345    function rescueETH(address destination) external payable onlyOwner {
346      (bool sent, ) = destination.call{value: msg.value}('');
347      require(sent, 'Failed to send Ether');
348:   }

https://github.com/code-423n4/2022-06-infinity/blob/765376fa238bbccd8b1e2e12897c91098c7e5ac6/contracts/staking/InfinityStaker.sol#L345-L348

HardlyDifficult commented 2 years ago

Dupe https://github.com/code-423n4/2022-06-infinity-findings/issues/296