##The setup

Utix's deployed MintedTokenCappedCrowdsaleExtv1 custodies raised ETH and pays it out to a configured multisig. At the time of review it held 451.32137 ETH.

##The lock

The withdrawal helper guards the payout wallet with an extcodesize == 0 "must be an EOA" check:

require(extcodesize(multisigWallet) == 0, "not an EOA");

But the configured multisigWallet is a Gnosis Safe — a contract, so extcodesize is non-zero and every withdrawal reverts.

The escape hatch is also broken: setMultisig discards the result of investorCount.plus(1) and reverts, so the wallet can't be repointed to an EOA either. The two defects together permanently freeze the full 451 ETH.

##Takeaway

extcodesize-based "EOA only" checks are an anti-pattern: they break smart-contract wallets (the norm for treasuries), give no real security against contracts (constructor bypass), and — when they gate withdrawals — turn into a self-inflicted, irreversible lock.

▸ full report