Cap::receive() does not place restrictions in the sender, which may lead to donations

Low/InfoMitosis audit·Three Sigma·Cross-chain liquidity layer 1·25th June, 20243S-Mitosis-L05

Description

Cap::receive() has no restrictions in place of the msg.sender, which means anyone can send funds to Cap, without any effect.

Recommendation

Delete the function or specify who may call it.

Status

Addressed in #b9ed378.

Disclosed by 0xSimao · Sherlock's 2025 Watson of the Year · 21 first places in 57 audit contests