DeFiFoundry
60,000 USDC
View results
Submission Details
Severity: low
Valid

using payable for `TradingAccountBranch::createTradingAccountAndMulticall` is rather unnecessary

Summary

TradingAccountBranch::createTradingAccountAndMulticall using a payable keyword makes it rather expensive to use since it may not be necesarry to send the native token when calling the function.

Vulnerability Details

it is difficult to call TradingAccountBranch::createTradingAccountAndMulticall function without setting msg.value since it is using a payable keyword. to use this function, you don't have to send funds to it so using the payable keyword is rather unnecessary. worse still if an inexperienced user sends funds in the bid to call the TradingAccountBranch::createTradingAccountAndMulticall, that fund will be stuck in the protocol

Impact

  • Poor uer experience when calling TradingAccountBranch::createTradingAccountAndMulticall

  • user may lose her fund to the protocol in the bid to use TradingAccountBranch::createTradingAccountAndMulticall function

Tools Used

  • manual review

Recommendations

  • remove the payable keyword from the TradingAccountBranch::createTradingAccountAndMulticall function

Updates

Lead Judging Commences

inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

`createTradingAccountAndMulticall` shouldn't be payable

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.