search

code-423n4 / 2022-03-lifinance-findings

6 stars 4 forks source link

Using the native `payable.transfer` to send ETH in `WithdrawFacet` #203

Closed code423n4 closed 2 years ago

code423n4 commented 2 years ago

Lines of code

https://github.com/code-423n4/2022-03-lifinance/blob/main/src/Facets/WithdrawFacet.sol#L31

Vulnerability details

Impact

The withdraw function in WithdrawFacet uses the native transfer keyword to send ETH, which is considered unsafe because of the fixed gas budget, and its functionality could be broken in some circumstances:

  1. The receiver consumes more than 2300 amounts of gas when receiving the ETH.
  2. Even if the receiver consumes less than 2300 amount of gas, the consumed gas amount could change in the future when hard forks happen and therefore could exceed the limit.

Proof of Concept

WithdrawFacet.sol#L31

Recommended Mitigation Steps

Consider using a low-level call to send ETH, for example, the LibAsset.transferNativeAsset function.

H3xept commented 2 years ago

Duplicate of #14