suzaku-network / suzaku-contracts-library

An open-source smart contracts library curated by the Suzaku team
Other
4 stars 0 forks source link

ICM: Add check to `send` functions #13

Closed Nuttymoon closed 1 month ago

Nuttymoon commented 1 month ago

image

Nuttymoon commented 1 month ago

To satisfy EEA EthTrust Security Level [S], code that makes external calls using the Low-level Call Functions (i.e. call, delegatecall, staticcall, send, and transfer) MUST check the returned value from each usage to determine whether the call failed. Normally, exceptions in subcalls 'bubble up', unless they are handled in a try/catch. However, Solidity defines a set of Low-level Call Functions that do not have built in safety checks: call, delegatecall, staticcall, send, and transfer. Calls using these functions behave differently. Specifically, they return a boolean indicating whether the call completed successfully. Not explicitly testing the return values of these calls for failure may lead to unexpected behavior in the caller contract.

Within AvalancheICTTRouter.sol, there are calls with missing failure checks. For instance:

Al3xGROS commented 1 month ago

I don't understand. In our case, the send function is not a low-level call function so I don't know what supplementary check I should do.