Submitted by cccz
The NFTMarketFees contract and the NFTMarketReserveAuction contract use the _sendValueWithFallbackWithdraw function to send ether to FoundationTreasury, CreatorRecipients, Seller, Bidder.
When the receiver fails to receive due to some reasons (exceeding the gas limit or the receiver contract cannot receive ether), it will record the ether to be sent in the pendingWithdrawals variable.
The user can then withdraw ether via the withdraw or withdrawFor functions.
However, the withdrawFor function can only send ether to the address recorded in pendingWithdrawals. When the recipient is a contract that cannot receive ether, these ethers will be locked in the contract and cannot be withdrawn.
https://github.com/code-423n4/2022-02-foundation/blob/main/contracts/mixins/SendValueWithFallbackWithdraw.sol#L37-L77
Add the withdrawTo function as follows:
NickCuso (Foundation) confirmed, but disagreed with High severity and commented:
Alberto Cuesta Caada (judge) decreased severity to Medium and commented:
