hats-finance / ether-fi-0x36c3b77853dec9c4a237a692623293223d4b9bc4

Smart Contracts for Ether Fi dapp
1 stars 1 forks source link

Use `.call` instead of `.transfer` #9

Open hats-bug-reporter[bot] opened 11 months ago

hats-bug-reporter[bot] commented 11 months ago

Github username: @Rotcivegaf Submission hash (on-chain): 0x5b8216d37457e2280fb9e132405fdb348aa4707553a5c214a3d8c5759e316bdf Severity: low

Description:

Description

The contract LoyaltyPointsMarketSafe use the .transfer to transfer native fund, but this only send only 2300 if the _to use more gas the transaction will revert

Use the .call to send native fund

Recommendation

@@ -31,7 +31,8 @@ contract LoyaltyPointsMarketSafe is Ownable {
     //-----------------------------------------------------------------------------

     function withdrawFunds(address payable _to) external onlyOwner {
-        _to.transfer(address(this).balance);
+        (bool success,) = _to.call{value: address(this).balance}("");
+        require(success, "Failed to transfer to _to");
     }
seongyun-ko commented 11 months ago

no attack vector here