Trick or Treat

Summary

The withdrawFees() function implements ETH transfers using the deprecated .transfer() method with a fixed gas stipend of 2,300 gas. This implementation, combined with the lack of reentrancy protection, creates a serious security risk that could result in either permanent fund locking or potential reentrancy attacks.

Vulnerability Details

The vulnerability stems from three main issues:

• Use of .transfer() which is hardcoded to 2,300 gas. Modern smart contract wallets often require more than 2,300 gas for their receive functions.

• Lack of Reentrancy Protection because there's nononReentrant modifier. `withdrawFees()` function doesn't follow CEIs pattern

  **Missing Success Verification: **The function doesn't verify if the transfer was successful

Impact

The vulnerability can lead to several several issues like:

1. Fund Locking

   • If the owner address is a smart contract wallet requiring >2,300 gas, funds become permanently locked

   • Network gas cost changes could make the function permanently unusable

2. ** Potential Reentrancy**

   • Without reentrancy protection, complex attack vectors could emerge

   • Multiple withdrawals might be possible in a single transaction

Tools Used

• Manual Review

• Foundry

Recommendations

Make sure to add nonReentrant modifier from OpenZeppelin and replace transfer() with call(), because `call()` is not limited to 2300 gas. After that checks