Usage of deprecated transfer to send ETH #52
Labels
2 (Med Risk)
Assets not at direct risk, but function/availability of the protocol could be impacted or leak value
bug
Something isn't working
duplicate
This issue or pull request already exists
Lines of code
https://github.com/code-423n4/2022-07-golom/blob/main/contracts/core/GolomTrader.sol#L151-L156
Vulnerability details
Impact
The use of the deprecated
transfer()
function will inevitably make the transaction fail when:More over, using higher than 2300 gas might be mandatory for some multisig wallets.
Proof of Concept
transfer()
andsend()
use a hardcoded gas amount.payEther()
function is using transfer (with fixed stipend 2300 gas)payEther()
is being used in multiple occasions for transfering native coin to some address for fees, payments and shares.Recommended Mitigation Steps
Using
call()
instead oftransfer()
The text was updated successfully, but these errors were encountered: