# receive() in glAVAX should only allow wAVAX Low/Info · Three Sigma · Liquid staking · 12th July, 2023 Finding 3S-GLACIER-L05 of the Glacier security review. - Protocol: https://www.glacier.io/ - Report: /reports/glacier - Source: https://cdn.sanity.io/files/qoqld077/production/21bd3b6fa78c55968a6c9c7ea4fd49f34a8bd3d8.pdf --- ### Description The current implementation of the [receive()](https://github.com/JackFrostDev/glacier-contracts/blob/main/contracts/protocol/GlacialAVAX/glAVAX.sol#L158) function in glAVAX allows any smart contract to call it, leading to lost funds. ```solidity receive() external payable { // prevents direct sending from a user require(msg.sender != tx.origin); } ``` ### Recommendation Refactor the function to only allow transfers from wAVAX. ```solidity receive() external payable { require(msg.sender == addresses.wavaxAddress()); } ``` ### Status Currently being reviewed by the team.