DittoETH

Summary

require should be used instead of assert.

assert Statement:

Purpose: The primary purpose of assert is to check for conditions that should never be false. It is used to identify programming errors or bugs in your code.

Behavior: When an assert statement evaluates to false, it indicates a critical error or bug in your code. It will trigger an exception or error, causing the execution of the program (or the contract) to halt.

Usage: assert is typically used to catch and prevent situations that should never occur in a well-functioning program. It is often used for internal consistency checks.

require Statement:

Purpose: The primary purpose of require is to check for valid conditions or inputs provided by users or external systems. It is used to ensure that the requirements for a function's execution are met.

Behavior: When a require statement evaluates to false, it signifies an invalid input or condition provided by the caller. It will trigger an exception and revert the transaction or operation, undoing any state changes.

Usage: require is typically used to validate inputs and ensure that a function can execute safely. It is often used for user input validation and preconditions.

Vulnerability Details

function unstake(address to, uint256 amount) external onlyDiamond {
IRocketTokenRETH rocketETHToken = _getRethContract();
uint256 rethValue = rocketETHToken.getRethValue(amount);
uint256 originalBalance = address(this).balance;
rocketETHToken.burn(rethValue);
uint256 netBalance = address(this).balance - originalBalance;
if (netBalance == 0) revert NetBalanceZero();
(bool sent,) = to.call{value: netBalance}("");
//@audit use require instead of assert;
assert(sent);
}
assert can't be used here

Impact

suppose when the transaction has failed it leads to critical error

Tools Used

manual

Recommendations

use require instead of assert.
function unstake(address to, uint256 amount) external onlyDiamond {
IRocketTokenRETH rocketETHToken = _getRethContract();
uint256 rethValue = rocketETHToken.getRethValue(amount);
uint256 originalBalance = address(this).balance;
rocketETHToken.burn(rethValue);
uint256 netBalance = address(this).balance - originalBalance;
if (netBalance == 0) revert NetBalanceZero();
(bool sent,) = to.call{value: netBalance}("");
-- assert(sent);
++require(sent,"transaction failed");
}