Mistakenly sent ETH will be Stuck

Summary

user can loose mistakenly sent ETH

Vulnerability Detail

According to Slither analyzer detector documentation (https://github.com/crytic/slither/wiki/Detector-Documentation#contracts-that-lock-ether)

Possible functions that receive funds with the payable attribute must have a withdraw function to secure that funds can be sent out from the function or remove payable attribute.

The SFrxETHAdapter.sol contract allows the reception of Ether through the standard receive() external payable function, which is designed to accept Ether transactions. However, the lack of a corresponding withdrawal function within the contract means that any received Ether cannot be redistributed or reclaimed, essentially becoming stuck within the contract's balance.

So, any if a user mistakenly send eth to the contract then it will be stuck and he won't be able to withdraw it

receive() external payable {
}

Given the contract's current implementation, there is no method available for the owners, users, or any other party to retrieve the locked funds.

Impact

The SFrxETHAdapter.sol contract have a receive() function without any withdrawal mechanism. This can leads to a scenario where any Ether (ETH) sent to the contract address becomes permanently locked within the contract, as there is no method to transfer or withdraw these funds.

Code Snippet

https://github.com/sherlock-audit/2024-01-napier/blob/main/napier-v1/src/adapters/frax/SFrxETHAdapter.sol#L46

Tool used

Manual Review

Recommendation

To resolve this issue, the following steps are recommended:

Implement a withdrawal function that allows the contract owner to transfer Ether out of the FeeSplitter contract.
The other method is to maintain a mapping of all the addresses that send funds to this contract but if a user send funds second time without withdrawing the first then his initial amount in the mapping will be list
Another logic is to use array to store the addresses, but if the array grows too big then it would DOS while traveling the array to find the address

In my opinion best way is the allow admin to withdraw the funds

References

https://solodit.xyz/issues/m-06-possible-locked-ether-funds-issue-in-rcorderbooksol-code4rena-reality-cards-reality-cards-contest-git

https://github.com/crytic/slither/wiki/Detector-Documentation#contracts-that-lock-ether

sherlock-audit / 2024-01-napier-judging

0xepley - Mistakenly sent ETH will be Stuck #19