search

sherlock-audit / 2023-10-looksrare-judging

6 stars 6 forks source link

MaslarovK - Funds may remain locked forever in InfiltrationPeriphery contract. #102

Closed sherlock-admin closed 1 year ago

sherlock-admin commented 1 year ago

MaslarovK

medium

Funds may remain locked forever in InfiltrationPeriphery contract.

Summary

InfiltrationPeriphery is able to receive ETH but there is no withdrawing functionality.

Vulnerability Detail

InfiltrationPeriphery contract has receive() function which is marked as payable and anyone is able to send ETH to this contract intentionally or by mistake.

Impact

Since there is no withdrawing functionality, all funds that are send directly to the contract without the heal function will remain locked forever but cannot withdraw it.

Code Snippet

https://github.com/sherlock-audit/2023-10-looksrare/blob/main/contracts-infiltration/contracts/InfiltrationPeriphery.sol#L95

Tool used

Manual Review

Recommendation

Implement withdrawing functionality, so if a user mistakenly sends funds to this contract, they can be withdrawn.

Duplicate of #59