sherlock-audit / 2024-02-optimism-2024-judging

6 stars 4 forks source link

turvec - WETH98 uses transfer instead of call which can break with future updates to gas costs #204

Closed sherlock-admin3 closed 6 months ago

sherlock-admin3 commented 7 months ago

turvec

medium

WETH98 uses transfer instead of call which can break with future updates to gas costs

Summary

Transfer will always send native token with a 2300 gas. This can be problematic for interacting smart contracts if gas cost change because their interaction may abruptly break.

Vulnerability Detail

See summary

Impact

Changing gas costs may break integrations in the future

Code Snippet

https://github.com/sherlock-audit/2024-02-optimism-2024/blob/main/optimism/packages/contracts-bedrock/src/dispute/weth/WETH98.sol#L49

Tool used

Manual Review

Recommendation

Use call instead of transfer.

Duplicate of #1