Multiple contracts in the system contain payable functions but lack a corresponding withdraw or sweep function, potentially leading to ETH being locked in the contract.
The AggregateRouter, V3Migrator, and NonfungiblePositionManager contracts all include payable functions that allow them to receive ETH. However, these contracts do not implement a dedicated withdraw function that would allow for the recovery of any ETH that might accidentally accumulate in the contract.
While these contracts are designed to handle ETH as part of their normal operations (typically forwarding it to other contracts or refunding users), the absence of a withdraw function means theres no direct mechanism to retrieve ETH if it becomes stuck due to unforeseen circumstances or edge cases.
The impact of this issue is considered low because:
Implement a withdraw function in each contract that allows an authorized address (e.g., the contract owner or governance) to withdraw any ETH that might accumulate. For example:
While the lack of a withdraw function in these contracts presents a potential for ETH to be locked, the low likelihood of significant ETH accumulation and the contracts design to handle ETH transiently rather than store it long-term classify this as a low severity issue that can be addressed to improve the contracts robustness and adhere to best practices.
