DittoETH

Summary

Is a bad practice to use assert() to create a revert, instead of require().

Vulnerability Details

Prior to solidity version 0.8.0, hitting an assert consumes the remainder of the transaction's available gas rather than returning it, as require()/revert() do. assert() should be avoided even past solidity version 0.8.0 as its documentation states that "The assert function creates an error of type Panic(uint256). ... Properly functioning code should never create a Panic, not even on invalid external input. If this happens, then there is a bug in your contract which you should fix".

Instances (3)

Impact

Bad practice that goes against solidity docs good practices.

Tools Used

Manual review, Solidity docs

Recommendations

Replace assert assumptions with require.