Payable functions

Summary

Contracts contain payable functions with no way to retrieve the native token.

Vulnerability Detail

To save on gas, many protocol functions have applied a payable modifier, for example:

  function addReferenceLendingPool(
    address _lendingPoolAddress,
    LendingProtocol _lendingPoolProtocol,
    uint256 _protectionPurchaseLimitInDays
  ) external payable onlyOwner {
    _addReferenceLendingPool(
      _lendingPoolAddress,
      _lendingPoolProtocol,
      _protectionPurchaseLimitInDays
    );
  }

As mentioned, "Function is marked payable as gas optimization". This means these functions can have a value attached to them even though the protocol does not have any intention to use it.

Impact

If the native token (ETH) accidentally reaches the contract, there is no way to send it back unless the contract is upgraded.

Code Snippet

https://github.com/sherlock-audit/2023-02-carapace/blob/main/contracts/core/pool/ReferenceLendingPools.sol#L116

and many more similar functions.

Tool used

Manual Review

Recommendation

Consider if this optimization is really worth it, and you might consider adding ETH and maybe other token rescue functions.

sherlock-audit / 2023-02-carapace-judging

HonorLt - Payable functions #232