Closed code423n4 closed 2 years ago
Agree that using .transfer is now discouraged. I think a difference here as compared to other contests is that the _to address is simply an input to this function call -- so if it reverts they could try again with a EOA and then transfer manually to the contract. Lowering risk and merging with the warden's QA report #157
Lines of code
https://github.com/code-423n4/2022-06-nibbl/blob/main/contracts/Basket.sol#L80
Vulnerability details
This is a classic Code4rena issue:
Impact
The use of the deprecated
transfer()
function for an address will inevitably make the transaction fail when:Additionally, using higher than 2300 gas might be mandatory for some multisig wallets.
Proof of Concept
withdrawETH()
usestransfer()
to transfer ETH:Recommended Migitation
I recommend using
call()
instead oftransfer()
.