code-423n4 / 2021-04-meebits-findings

0 stars 0 forks source link

.transfer is not safe to use with custom smart contracts #50

Open code423n4 opened 3 years ago

code423n4 commented 3 years ago

Handle

paulius.eth

Vulnerability details

Impact

.transfer is used for transferring ether. It is no longer recommended as recipients with custom fallback functions (smart contracts) will not be able to handle that. You can read more here: https://consensys.net/diligence/blog/2019/09/stop-using-soliditys-transfer-now/

Recommended Mitigation Steps

Solution (don't forget re-entrancy protection): https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/utils/Address.sol#L53-L59