InfinityStaker: The rescueETH function cannot rescue any ETH accidentally sent to the contract

[code423n4]

Lines of code

https://github.com/code-423n4/2022-06-infinity/blob/765376fa238bbccd8b1e2e12897c91098c7e5ac6/contracts/staking/InfinityStaker.sol#L345-L348

Vulnerability details

Impact

The rescueETH function of the InfinityStaker contract is used to withdraw the ether from the contract, but the value of .call is msg.value instead of this.balance, which prevents the owner from withdrawing the ether from the contract

Proof of Concept

https://github.com/code-423n4/2022-06-infinity/blob/765376fa238bbccd8b1e2e12897c91098c7e5ac6/contracts/staking/InfinityStaker.sol#L345-L348

Tools Used

None

Recommended Mitigation Steps

function rescueETH(address destination) external payable onlyOwner {
-    (bool sent, ) = destination.call{value: msg.value}(' ');
+   (bool sent, ) = destination.call{value: address(this).balance}('');
      require(sent, 'Failed to send Ether');
}

[nneverlander]

Duplicate

[nneverlander]

#11

[HardlyDifficult]

Dupe #296