Ether may be permanently locked if a call to refund address fails

[c4-bot-2]

Lines of code

https://github.com/code-423n4/2024-01-decent/blob/main/src/UTBExecutor.sol#L54

Vulnerability details

Impact

Users may lose Ether in the event of both action execution and refund call failure in the UTBExecutor.sol::execute function. While it is assumed that users must supply their own address as refund, there are no safety checks to verify that refund is indeed an Externally Owned Account (EOA). As a consequence of a refund.call failure, the Ether amount will remain in the UTBExecutor.sol contract with no option for users to claim these funds thus Ether amount becomes permanently locked in the contract.

Proof of Concept

if (token == address(0)) {
    (success, ) = target.call{value: amount}(payload);
    if (!success) {
        (refund.call{value: amount}(""));   // <== funds stay locked in the contract!!!
    }
    return;
}

Tools Used

Manual review

Recommended Mitigation Steps

Consider adding an access-controlled withdrawEth function.

Assessed type

call/delegatecall

[c4-pre-sort]

raymondfam marked the issue as insufficient quality report

[c4-pre-sort]

raymondfam marked the issue as duplicate of #25

[c4-judge]

alex-ppg marked the issue as unsatisfactory:
Invalid