F-2025-0009·access-control

Incorrect access control in TreasuryBTC::withdrawForStaking

Acknowledgedrafflelotteryvrf
TL;DR

The withdrawForStaking function uses both onlyOwner and a require(msg.sender == founder || msg.sender == owner()) check, making the founder check effectively unreachable when founder differs from owner.

Severity
MEDIUM
Impact
MEDIUM
Likelihood
MEDIUM
Method
MManual review
CAT.
Complexity
LOW
Exploitability
LOW
02Section · Description

Description

The function TreasuryBTC::withdrawForStaking has a conflicting access control design: it checks msg.sender == founder || msg.sender == owner(), but the onlyOwner modifier already restricts access to the owner. So, the founder can never call the function if they are not the owner.

solidity
function withdrawForStaking(uint256 amount) external onlyOwner {
require(msg.sender == founder || msg.sender == owner(), "Only founder");
// ...
}
03Section · Recommendation

Recommendation

Remove the onlyOwner modifier.

04Section · Resolution

Resolution

Nexalo: withdrawForStaking functionality has been completely removed.

Zealynx: If the founder was supposed to have withdrawal access independent of the owner, that's now lost.

F-2025-0009

oog
zealynx

Smart Contract Security Digest

Monthly exploit breakdowns, audit checklists, and DeFi security research — straight to your inbox

© 2026 Zealynx