Sparkn

Summary

Gas griefing/theft is possible on an unsafe external call

Vulnerability Details

A low-level call will copy any amount of bytes to local memory. When bytes are copied from returndata to memory, the memory expansion cost is paid.

Impact

Low level call means that when using a standard solidity call, the callee can 'returnbomb' the caller, imposing an arbitrary gas cost.
Because this gas is paid by the caller and in the caller's context, it can cause the caller to run out of gas and halt execution.

Tools Used

Manual code review

Recommendations

Consider replacing all unsafe call with excessivelySafeCall from this contract.