PrisonArt / restore

Restoring human dignity one piece at a time
https://pr1s0n.art
MIT License
6 stars 1 forks source link

Risk of double spending in `_safeTransferETHWithFallback` #1

Closed dievardump closed 2 years ago

dievardump commented 2 years ago

https://github.com/PrisonArt/restore/blob/3472e75509e09e1de3952a0a2c80e9db4b7a73f0/packages/hardhat-ts/contracts/Justice.sol#L235-L268

There is a risk of double spending in here.

Let's say that only one of the 3 Ethereum transfer fails, but not the 2 others, the function _safeTransferETHWithFallback will still go in the "weth" fallback, and will try to transfer again the share to all 3 wallets, although 2 already got theirs.

Depending how much funds are in the contract, this might either fail, either deposit & send funds that should be, since they were already sent in ETH.