Dos in callFacet.call()

[code423n4]

Handle

JMukesh

Vulnerability details

Impact

In function call( address[] memory _targets, bytes[] memory _calldata, uint256[] memory _values ) {}

if any one of the address is contract and implemented revert() in its fallback() , then all other transaction will get failed due this one transation

Proof of Concept

https://github.com/code-423n4/2021-12-amun/blob/98f6e2ff91f5fcebc0489f5871183566feaec307/contracts/basket/contracts/facets/Call/CallFacet.sol#L71

Tools Used

manual reveiw

Recommended Mitigation Step

favor-pull-over-push-for-external-calls

https://consensys.github.io/smart-contract-best-practices/recommendations/#favor-pull-over-push-for-external-calls

[0xleastwood]

I don't see how this might be an issue. The protectedCall modifier expects the caller to be the contract itself or the contract owner. So I expect the target addresses to be vetted by whoever calls the function. A pull over push isn't really ideal in this case.