Tadle

Summary:

withdrawal operation where native tokens are first withdrawn from a wrapper contract and then transferred to the user. The issue arises from the use of the deprecated transfer method for sending native tokens, which can cause reverts

Vulnerability Details:

https://github.com/Cyfrin/2024-08-tadle/blob/main/src/core/TokenManager.sol#L169

The transfer method for sending native tokens (ETH) is known to have limitations, particularly with regard to gas stipends and reverts. This method transfers a fixed amount of gas (2300 gas) to the recipient, which may not be sufficient if the recipient's fallback function requires more gas to execute. This can lead to failed transactions or reverts, especially if the recipient contract has complex logic.

Example: In the provided code, the transfer function is used to send native tokens to the caller (msg.sender) after withdrawing from the wrapper contract. If msg.sender is a contract and requires more gas for its fallback function, the transfer may fail

Impact:

If the recipient's fallback function requires more gas than the 2300 gas provided by transfer, the transaction will fail. This can cause user funds to not be transferred as expected.
Loss of Funds: Users may not receive their funds if the transaction reverts, potentially leading to loss or inaccessibility of their assets

Tools Used:

Manual review

References:

The issues with transfer() are outlined here:

https://consensys.net/diligence/blog/2019/09/stop-using-soliditys-transfer-now/

Recommendations:

Using low-level call.value(amount) with the corresponding result check or using the OpenZeppelin Address.sendValue is advised