Skip to content
Request an audit

‹ Findings database

Balance check in Vault::withdraw() does not take fees into account

MediumOrange Bridge audit·Three Sigma·Cross-chain bridge·15th July, 20243S-OB-M01

Description

Vault::withdraw() transfers funds to an user if address(this)).balance >= amount, which may transfer funds resulting from fees.

Recommendation

Replace the check by address(this)).balance - totalFees >= amount to make sure fees can always be withdrawn.

Status

Addressed in #cdd25c9.