Summary

The MultiflowPump contract makes contract calls to external contracts wrapped in a try catch to avoid reverting, the wrapper does not cover for all situations and could still revert for a number of reasons.

Vulnerability Details

The try catch solidity function does not behave as intended in a couple of situations:

1. it crashes if calling non-existent address (e.g. address(0))

2. it crashes if the target contract doesn't have that method.

3. it crashes if the target contract returns wrong number of arguments.

Impact

Revert of operation causing unintended reverts when called internally

Tools Used

manual

Recommendations

Perform other prior validations that mitigate against the weak points of try catch before using it.