InfinityStaker and InfinityExchange are prone to "donate" user's ether by mistake

[code423n4]

Lines of code

https://github.com/code-423n4/2022-06-infinity/blob/601e0e5498587f5b1ae33f345223c86526ae9ce1/contracts/staking/InfinityStaker.sol#L345-L348
https://github.com/code-423n4/2022-06-infinity/blob/601e0e5498587f5b1ae33f345223c86526ae9ce1/contracts/core/InfinityExchange.sol#L1229

Vulnerability details

Impact

The methods receive and fallback are payable and the doesn't track the user ether, so the user's ether can be locked until owner decide.

The contracts contains a method to get the accidentally ether by the admin

/// @dev Admin function to rescue any ETH accidentally sent to the contract

But also, it facilitate the human errors with the payable methods receive and fallback.

Affected source code:

• InfinityStaker.sol#L345-L348
• InfinityExchange.sol#L1229

Recommended Mitigation Steps

• Avoid accidentally sending ether by removing the receive and fallback method, otherwise the owner is in charge of MAYBE return the funds.

[nneverlander]

Duplicate

[0x1f8b]

Duplicate

@nneverlander could you add the issue number, it's easier for tracking

[HardlyDifficult]

I agree that this should be addressed. But this is just preventing user error and shouldn't come up during normal use. Plus the admin could refund them (once the withdraw bug is fixed of course). Lowering risk and merging with the warden's QA report #16