[Security][Low][rescueETH] transfer() with 2300 gas stipend can permanently lock ETH

[igor53627]

Summary

rescueETH() uses Solidity .transfer() which forwards only 2300 gas. If owner is a smart contract with a gas-intensive receive/fallback, ETH recovery will always revert.

Audit Source

• Report: audit/liq_audit_report_1.json (Finding Optimization: Skip pre-balance check #3)
• Tool: Nethermind AuditAgent
• Date: 2026-01-02

Location

src/LIQFlashYul.sol - lines 256-259

function rescueETH() external {
    require(msg.sender == owner, "NOT_OWNER");
    payable(owner).transfer(address(this).balance);
}

Impact

• Permanent loss of ETH if owner is a contract requiring >2300 gas
• ETH can accumulate via receive() and fallback()

Severity Justification

Low - Only affects owner, easily avoided by using an EOA owner. However, could cause permanent fund loss.

---

Proposed fix (Oracle, unreviewed):

Use call pattern:

function rescueETH() external {
    require(msg.sender == owner, "NOT_OWNER");
    (bool success, ) = owner.call{value: address(this).balance}("");
    require(success, "ETH_TRANSFER_FAILED");
}

[igor53627]

Fixed by removing ETH handling entirely:

• fallback() external (removed payable)
• Removed receive() external payable {}
• Removed rescueETH() function
• Unknown selectors now revert instead of stop()

Contract no longer accepts ETH (except via selfdestruct/coinbase which cannot be blocked).

[devin-ai-integration]

This issue references a rescueETH() function that does not exist in the current contract code.

Looking at src/LIQFlashYul.sol, the contract only has these functions:

• flashLoan() - ERC-3156 flash loan
• maxFlashLoan() - Returns available liquidity
• flashFee() - Always returns 0
• deposit() - Deposit USDC
• withdraw() - Withdraw USDC (owner only)
• sync() - Sync poolBalance to actual balance (owner only)
• transferOwnership() - Transfer ownership

There is no rescueETH() function. This issue may have been generated from an audit of an older version or a different contract.

Note: I also updated SECURITY.md in PR #15 to remove the reference to the non-existent rescueETH() function.

This issue can likely be closed as not applicable to the current contract.