Closed Nuttymoon closed 1 month ago
To satisfy EEA EthTrust Security Level [S], code that makes external calls using the Low-level Call Functions (i.e. call, delegatecall, staticcall, send, and transfer) MUST check the returned value from each usage to determine whether the call failed. Normally, exceptions in subcalls 'bubble up', unless they are handled in a try/catch. However, Solidity defines a set of Low-level Call Functions that do not have built in safety checks: call, delegatecall, staticcall, send, and transfer. Calls using these functions behave differently. Specifically, they return a boolean indicating whether the call completed successfully. Not explicitly testing the return values of these calls for failure may lead to unexpected behavior in the caller contract.
Within AvalancheICTTRouter.sol, there are calls with missing failure checks. For instance:
The call IERC20TokenTransferrer(bridgeHome).send(input, bridgeAmount) within the contract AvalancheICTTRouter.
The call INativeTokenTransferrer(bridgeHome).send{value: bridgeAmount}(input) within the contract AvalancheICTTRouter.
I don't understand. In our case, the send
function is not a low-level call function so I don't know what supplementary check I should do.