F-2024-0007·missing-validation

Potential removal of unclaimed winning tokens

Acknowledgeddexammraffle
TL;DR

removeToken does not check for unclaimed winnings before removing a supported token, trapping users' winnings in the contract once that token is no longer supported.

Severity
MEDIUM
Impact
MEDIUM
Likelihood
MEDIUM
Method
MManual review
CAT.
Complexity
LOW
Exploitability
LOW
02Section · Description

Description

The MonadexV1Raffle contract's removeToken function currently lacks a mechanism to handle unclaimed winnings when removing a supported token. This oversight creates a significant vulnerability that could lead to the permanent loss of user funds and undermine the integrity of the raffle system.

In the current implementation, when a token is removed from the supported list, any unclaimed winnings denominated in that token become effectively trapped within the contract. The contract maintains a record of these winnings in the s_winnings mapping, but once the token is no longer supported, users have no way to claim these funds.

03Section · Impact

Impact

Users with unclaimed winnings in the removed token will lose access to their rightfully earned prizes. This represents a direct financial loss for participants, which could range from negligible amounts to potentially significant sums.

04Section · Recommendation

Recommendation

Implement a check for unclaimed winnings before token removal. Or alternatively, implement a migration mechanism for unclaimed winnings.

F-2024-0007

oog
zealynx

Smart Contract Security Digest

Monthly exploit breakdowns, audit checklists, and DeFi security research — straight to your inbox

© 2026 Zealynx