# ETHCrowdfundBase.sol: All funds are lost when fee recipient cannot receive ETH

ETHCrowdfundBase._finalize transfers fees to an immutable fundingSplitRecipient; if that address reverts on ETH receipt, finalization is bricked and all contributions are stuck.

- Payout: Contest reward
- Severity: medium
- Program: PartyDAO
- Credited: HollaDieWaldfee
- Disclosed: 2023-06-23
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-04-party-findings/issues/8
- Library page: https://bugbountylibrary.com/r/c4%3A2023-04-party%3AM-08
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** ETHCrowdfundBase.sol crowdfund contract
**Root cause:** _finalize performs an unconditional transferEth of the fee to fundingSplitRecipient inside the finalization path; a reverting recipient aborts finalize, and the Won state blocks refunds.
**Steps:**
1. Configure crowdfund with fundingSplitRecipient set to a contract that reverts on ETH receive and fundingSplitBps > 0.
2. Crowdfund reaches Won state.
3. Call finalize() -> _finalize computes feeAmount and calls fundingSplitRecipient_.transferEth(feeAmount), which reverts.
4. Finalize can never succeed; refunds unavailable in Won state; all ETH stuck.
**How found:** Code reading of _finalize: noticed the fee transfer to an immutable recipient is coupled to finalization, and that a reverting recipient has no fallback path while the Won state blocks refunds.
**Exploitation:** Griefing: a malicious or mistaken fundingSplitRecipient that reverts on receive causes every finalize() call to revert, permanently locking all contributed ETH and denying contributors voting power.
**Insight:** When a payout to a configurable/immutable recipient is embedded in a state-transition function, check whether that recipient can revert and whether the resulting state blocks the escape hatch (refunds); isolate fee transfers into a separate pull-based function.