mediumAccess controlEVM-Solidity
Putty: [Denial-of-Service] Contract Owner Could Block Users From Withdrawing Their Strike
- Payout
- $0
- Protocol
- Putty
- Disclosed
- Aug 7, 2026
- Source
- code4rena
PuttyV2's withdraw function deducts a platform fee from a user's escrowed strike and transfers that fee to the contract owner inline, before sending the remaining strike to the user. Because the user's transfer only executes if the owner fee transfer succeeds, …
Similar reports
- No close matches yet.
References
- https://github.com/code-423n4/2022-06-putty-findings/issues/296
- https://github.com/code-423n4/2022-06-putty-findings
This report is already public and closed. Coin Buggie never publishes active or unpatched vulnerability data.