Low risk (L3): withdrawGasToken signals gas token will be in the contract, but no receive() method is present

[petrovska-petro]

Severity: if ether is sent without defining the receive() method in the smart contract, it will throw an exception

Context: the method withdrawGasToken suggests that gas balance will be in the contract, but no proper way to received actual gas in the contract

uint256 amount = address(this).balance;
recipient.transfer(amount);

Recommendation: see documentation and add at least a receive() method if intention is to receive gas tokens into the injector.

Review stage

Balancer Maxis:

• Acknowledge
• Fixed

Onchainification Labs:

• Acknowledge correction/mitigation

[Tritium-VLK]

It is not intended for the injector to hold gas tokens. I guess then could just remove this function. This is just kind of the baseline of what I have used as a admin owned, fully controlled, max flexibillity helper.

[petrovska-petro]

Then, indeed makes sense to remove withdrawGasToken from the contract

[petrovska-petro]

approved #38

once merged into main, feel free to close this issue ✅