search

code-423n4 / 2021-12-amun-findings

0 stars 0 forks source link

Consider sending native token using .call instead of .transfer #165

Closed code423n4 closed 2 years ago

code423n4 commented 2 years ago

Handle

kenzo

Vulnerability details

In various singleJoinExit files, native token is being sent to the user using transfer function. Although in the past it was it was recommended, these days the general recommended way to send native token is using call. This is because of 2 reasons -

  1. transfer does not fully protect from reentrancy as gas costs can change. (In your scenario there is no risk of reentrancy.)
  2. transfer will only forward small amount of gas. So if for example the msg.sender is a smart contract that wants to do something with received ether (eg. deposit in some other platform), he will not be able to do it. This kinda breaks the composability of the ecosystem. You can read a little more about it in this Consensys article.

Proof of Concept

The following files use transfer: EthSingleTokenJoin, EthSingleTokenJoinV2, SingleNativeTokenExit, SingleNativeTokenExitV2. All of them use it in the last line of external function so there's no reentrancy concern.

Recommended Mitigation Steps

Consider if using call will be better for your use case. I think that there's no drawback to moving to call, and you'll gain composability.

loki-sama commented 2 years ago

duplicate #175