The GraphProxy contract implements receive() and fallback() functions to receive funds. However, there is no method associated with a user to withdraw his funds which might be sent accidentally to the proxy contract, thus leading to most of the eth locked in the contract except in a case of selfdestruct.
Proof of Concept
fallback() external payable {
_fallback();
}
/**
* @dev Fallback function that delegates calls to implementation. Will run if call data
* is empty.
*/
receive() external payable {
_fallback();
}
Tools Used
Manual review
Recommended Mitigation Steps
A function to allow withdrawal of funds mistakenly sent to contract could be implemented.
Lines of code
https://github.com/code-423n4/2022-10-thegraph/blob/main/contracts/upgrades/GraphProxy.sol#L191-L201
Vulnerability details
Impact
The GraphProxy contract implements receive() and fallback() functions to receive funds. However, there is no method associated with a user to withdraw his funds which might be sent accidentally to the proxy contract, thus leading to most of the eth locked in the contract except in a case of selfdestruct.
Proof of Concept
Tools Used
Manual review
Recommended Mitigation Steps
A function to allow withdrawal of funds mistakenly sent to contract could be implemented.