> **Can't find what you're looking for?** Use `search_docs` on the docs MCP server at `https://www.getfoundry.sh/api/mcp` to find what you need.
>
> **Have feedback?** Use `submit_feedback` on the same MCP server.

## Arbitrary Send ETH

**Severity**: `High`
**ID**: `arbitrary-send-eth`

### What it does

Flags ETH transfers to caller-controlled destinations in functions without a recognized
caller restriction. This includes `transfer`, `send`, calls with `{value: ...}`,
`selfdestruct`, and common OpenZeppelin and Solady ETH-transfer helpers.

Constructors and library bodies are excluded.

### Known limitations

A warning may remain when access control is enforced by a caller or a role-checking helper.
Review that protection before suppressing it.

### Why is this bad?

If an attacker can choose the recipient of ETH transfers they can drain the
contract balance, redirect user funds, or trivially bypass weak access
controls.

### Example

```solidity
contract Vault {
    function withdraw(address payable to, uint256 amount) external {
        to.transfer(amount); // attacker passes their own address
    }
}
```

Use instead:

```solidity
contract Vault {
    address payable public immutable owner;

    constructor(address payable _owner) { owner = _owner; }

    modifier onlyOwner() { require(msg.sender == owner); _; }

    function withdrawTo(address payable to, uint256 amount) external onlyOwner {
        to.transfer(amount);
    }
}
```