The Standard
The Standard
DeFiHardhat
20,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

The `forwardRemainingRewards` function contains unchecked external calls, which may expose the contract to potential loop holes

0xVinylDavyl

Summary

An attacker may manipulate the call to exploit vulnerabilities or interfere with the contract's intended behavior.
The protocol.call{value: balance}(""); and IERC20(_token.addr).transfer(protocol, balance); lines in the forwardRemainingRewards function perform unchecked external calls, which may lead to unexpected behavior and could potentially be exploited.

Vulnerability Details

​
​
function forwardRemainingRewards(ITokenManager.Token[] memory _tokens) private {
for (uint256 i = 0; i < _tokens.length; i++) {
ITokenManager.Token memory _token = _tokens[i];
if (_token.addr == address(0)) {
uint256 balance = address(this).balance;
if (balance > 0) {
(bool _sent,) = protocol.call{value: balance}("");
require(_sent);
}
} else {
uint256 balance = IERC20(_token.addr).balanceOf(address(this));
if (balance > 0) IERC20(_token.addr).transfer(protocol, balance);
}
}
}
​

These lines singly also:

(bool _sent, ) = protocol.call{value: balance}("");
require(_sent, "external call failed");
IERC20(_token.addr).transfer(protocol, balance);

Impact

The forwardRemainingRewards function contains unchecked external calls, which may expose the contract to potential vulnerabilities. The lines protocol.call{value: balance}(""); and IERC20(_token.addr).transfer(protocol, balance); lack proper validation, creating a risk of unexpected behavior and potential exploitation.

Tools Used

VsCode / Manual

Recommendations

Implement proper validation for external calls to ensure their success and mitigate potential reentrancy issues. Enhance the security of the contract and prevent exploitation risks.

Updates

Lead Judging Commences

hrishibhat Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

informational/invalid

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.