Tadle

Summary

The transfer() function in Solidity is limited to 2300 gas, which can be insufficient if the receiving contract's fallback or receive function involves more complex logic. This can lead to the transaction reverting if the gas limit is exceeded.

Vulnerability Details

The protocol uses Solidity's transfer() function to transfer ETH to recipients here. However, this method has significant limitations when the recipient is a smart contract, as it can make transferring ETH impossible. The transfer will fail if the smart contract:

• does not implement a payable fallback function

• Implements a payable fallback function that would consume more than 2300 gas units.

• implements a payable fallback function incurring less than 2300 gas units but is called through a proxy that raises the call’s gas usage above 2300.

Impact

Funds get stuck

Tools Used

Manual

Recommendations