Report #33129

Report ID

#33129

Report type

Smart Contract

Has PoC?

Yes

Target

https://etherscan.io/address/0xC1E088fC1323b20BCBee9bd1B9fC9546db5624C5

Impacts

Untracked Balances on receive function

Description

Diamond.sol: 24 Without keeping track of the received funds, it becomes difficult to audit or monitor the incoming transactions. This could lead to a lack of transparency and the protocol to be accountable. The contract also does not have a withdraw function which means funds will be stuck in that contract forever.

Vulnerability Details

The receive function will work and if not the fallback function will kick in. However what concerns me is that balances received by this smart contract are not tracked and the lack of a mapping results in the protocol also not knowing who sent however much. The management of funds will fail and there is no transparency. How will the contract give out refunds for example.

Impact Details

The funds received will simply be stored in the contract without a proper management system. Without knowing who what made the payment.

References

https://etherscan.io/address/0xC1E088fC1323b20BCBee9bd1B9fC9546db5624C5?utm_source=immunefi#code Diamond.sol: 24

Proof of concept

// Empty receive function
contract FundReceiver {
    receive() external payable {}

// Function to withdraw all funds from the contract
function withdrawAll(address payable recipient) external {
    recipient.transfer(address(this).balance);
}

}