search

code-423n4 / 2022-01-openleverage-findings

0 stars 0 forks source link

.transfer is used for transferring ether #238

Closed code423n4 closed 2 years ago

code423n4 commented 2 years ago

Handle

pauliax

Vulnerability details

Impact

.transfer is no longer recommended as recipients with custom fallback functions (smart contracts) will not be able to handle that:

if (address(token) == weth) {
    IWETH(weth).withdraw(amount);
    payable(to).transfer(amount);

You can read more here: https://consensys.net/diligence/blog/2019/09/stop-using-soliditys-transfer-now/

Recommended Mitigation Steps

Solution (don't forget re-entrancy protection): https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/utils/Address.sol#L53-L59

ColaM12 commented 2 years ago

Duplicate to #228