Prevent users sending unexpected ETH to protocol

[code423n4]

Lines of code

https://github.com/code-423n4/2022-07-golom/blob/main/contracts/core/GolomTrader.sol#L459-L461

Vulnerability details

Impact

The protocol receives ETH by defining receive() and fallback() functions. Users will lose ETH when he/she accidentally sends ETH to the protocol.

Proof of Concept

https://github.com/code-423n4/2022-07-golom/blob/main/contracts/core/GolomTrader.sol#L459-L461

    fallback() external payable {}

    receive() external payable {}

Tools Used

None

Recommended Mitigation Steps

  receive() external payable {
    require(msg.sender == address(WETH));
  }

[0xsaruman]

duplicate #755

[dmvt]

Lack of a recovery function is low risk. Downgrading to QA.