Malicious user can spam the receive() function in the Minter contract.

[hats-bug-reporter]

Github username: --
Twitter username: --
Submission hash (on-chain): 0x24a872d04a702d6995f03938931241f75da9a45de1314d2fd7c49c16ad373ae5
Severity: low

Description:
Description
The receive() function in the Minter contract emits an event for every transfer to the contract.

    // receive() function to handle plain gas token transfers
    receive() external payable {
        emit FundsReceived(msg.sender, msg.value);
    }

It might be used in the UI to handle native transfers to the contract.
However, there is no minimum transfer amount enforced, and the gas fees on OASIS Sapphire are much lower compared to Ethereum. Therefore, a malicious user could spam this event by transferring just 1 wei as many times as possible.

Recommendation
Consider setting a minimum transfer amount for the receive() function.

    receive() external payable {
+      require(msg.value > MIN_TRANSFER);
        emit FundsReceived(msg.sender, msg.value);
    }

[ilzheev]

Events are informational

[0xdanial]

@ilzheev thanks for your comment.

If issue #10 is considered low severity, this should also be considered low as well.

As @0xRizwan mentioned in the comment on issue #10 :

The gas fees on OASIS Sapphire are much lower compared to Ethereum. Malicious users often target low gas fee chains for phishing activities, etc. With such low fees, a user can send multiple transactions. Adopting a minimum deposit check in staking/deposits is a common practice to prevent low depositors, malicious users, or spammers. In my opinion, it's better to implement the validation check to prevent some issues rather than none.

Emitting in the receive() function shows that you want to track received funds, but the report clearly shows that spamming this emit can disrupt the tracking process.

Best regards.

[0xRizwan]

If user directly transfer native tokens to contract then its user mistake. #10 is different issue. Events are emitted for transparency and nothing to do with spams, etc.

It might be used in the UI to handle native transfers to the contract.

Please check https://testnet.accumulated.finance/stake/rosebeta to understand users interaction with contract specific functions.