Skinny Licorice Ostrich
Medium
The receive function allows the owner to send Ether to the contract but does not provide a mechanism to withdraw it.
function __Messenger_init(address _counterpart, address _feeVault) internal onlyInitializing { OwnableUpgradeable.__Ownable_init(); PausableUpgradeable.__Pausable_init(); ReentrancyGuardUpgradeable.__ReentrancyGuard_init();
// initialize to a nonzero value
xDomainMessageSender = Constants.DEFAULT_XDOMAIN_MESSAGE_SENDER;
counterpart = _counterpart;
if (_feeVault != address(0)) {
feeVault = _feeVault;
}
}
/* solhint-enable */
// make sure only owner can send ether to messenger to avoid possible user fund loss.
@>> receive() external payable onlyOwner {}
Manual Review
Implement a withdrawal function for the owner to retrieve Ether from the contract.