Submitted by ScopeLift, also found by nathaniel
On lines 85 and 101, ETH is transferred using a .call to an address provided as an input, but there is no verification that the call call succeeded. This can result in a call to emergencyWithdrawGAS or partialWithdrawGAS appearing successful but in reality it failed. This can happen when the provided destination address is a contract that cannot receive ETH, or if the amount provided is larger than the contracts balance
Enter the following in remix, deploy the Receiver contract, and send 1 ETH when deploying the Permissions contract. Call emergencyWithdrawGAS with the receiver address and youll see it reverts. This would not be caught in the current code
Remix
In emergencyWithdrawGAS:
And similar for partialWithdrawGAS
0xScotch (sponsor) confirmed 
Alex the Entreprenerd (judge) commented:
