Submission Details
Severity:
Missing contract-existence checks before low-level calls
Summary
Low-level calls return success even if there is no code present at the specified address.
Vulnerability Details
There is 1 instance of this issue.
File: contracts/bridges/BridgeReth.sol
105: (bool sent,) = to.call{value: netBalance}("");
| File Link | Instance Count | Instance Link |
|---|---|---|
| BridgeReth.sol | 1 | 105 |
Impact
Potential to send funds to an address that cannot handle receiving them.
Tools Used
baudit: a custom static code analysis tool; manual review
Recommendations
In addition to the zero-address checks, consider adding a check to verify that <address>.code.length > 0.
Prize pool breakdown
Total prize
55,000 USDC
nSLOC
3,36516 USDC / LOC
50,000 USDC
5,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.