Closed code423n4 closed 1 year ago
Picodes marked the issue as duplicate of #280
Picodes marked the issue as partial-25
This could be used to DoS the system but no impact is described in this report
Picodes changed the severity to QA (Quality Assurance)
Picodes marked the issue as grade-c
Lines of code
https://github.com/code-423n4/2023-05-ajna/blob/276942bc2f97488d07b887c8edceaaab7a5c3964/ajna-grants/src/grants/base/ExtraordinaryFunding.sol#L56
Vulnerability details
Impact
The
executeExtraordinary
of the ExtraordinaryFunding.sol file transfersvalue_
but does not have thepayable
keyword. TheexecuteExtraordinary
is supposed to be able to accept Ether denoted byvalue_
argument but lacks the payable keyword so every transaction with ETH to theexecuteExtraordinary
will revert.Proof of Concept
The
executeExtraordinary
function calls the_execute
which implements thecall
function with value but theexecuteExtraordinary
lacks thepayable
keyword which will make every call toexecuteExtraordinary
with Ether to revert.https://github.com/code-423n4/2023-05-ajna/blob/276942bc2f97488d07b887c8edceaaab7a5c3964/ajna-grants/src/grants/base/ExtraordinaryFunding.sol#L56 https://github.com/code-423n4/2023-05-ajna/blob/276942bc2f97488d07b887c8edceaaab7a5c3964/ajna-grants/src/grants/base/ExtraordinaryFunding.sol#L81
Tools Used
Manual Review
Recommended Mitigation Steps
Add
payable
keyword to theexecuteExtraordinary
function of the ExtraordinaryFunding.sol file.Assessed type
Payable