Submission Details
Severity:
No transfer result check in `_payPrefund` fucntion
Summary
No transfer result check in _payPrefund fucntion
Vulnerability Details
The validateUserOp function will pay prefund to msg.sender .
But there is no validation of whether this _payPrefund is success .
function _payPrefund(uint256 missingAccountFunds) internal virtual {
if (missingAccountFunds != 0) {
(bool success,) = payable(msg.sender).call{value: missingAccountFunds, gas: type(uint256).max}("");
(success);
}
}
Impact
This _payPrefund transaction might be failed, but the validation can be success .
Tools Used
Mannual review, Foundry
Recommendations
Add _payPrefund function execution results' check .
Rewards breakdown
nSLOC
89This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.