search

code-423n4 / 2024-06-vultisig-validation

0 stars 0 forks source link

Avoid using of transfer() #668

Open c4-bot-3 opened 2 months ago

c4-bot-3 commented 2 months ago

Lines of code

https://github.com/code-423n4/2024-06-vultisig/blob/main/hardhat-vultisig/contracts/Whitelist.sol#L73

Vulnerability details

Impact

Transferring fund back to a caller with the built-in function .transfer() can be problematic if the msg.sender is a smart contract.

The transfer() call requires that the recipient has a payable callback, only provides 2300 gas for its operation. This means the following cases can cause the transfer to fail:

  1. The contract does not have a payable callback
  2. The contract's payable callback spends more than 2300 gas

Tools Used

Manual Review

Recommended Mitigation Steps

Use call{value:x}() instead.

Assessed type

ETH-Transfer