TwentyOne
First Flight #29
Beginner FriendlyGameFiFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

Gas stipend limitation in ether transfer causes potential payout failures

sstoqnov_

Summary

In endGame() function the transfer used for Ether payouts in the contract is prone to failure due to its 2300-gas stipend limit.

Vulnerability Details

The contract uses transfer to send Ether to the player upon winning. This imposes a 2300-gas stipend, which may fail if the recipient is a contract with a fallback function consuming more gas.

payable(player).transfer(2 ether);

The Solidity best pracise is to use call for transferring Ether, as it provides greater flexibility by forwarding all available gas to the recipient.

Impact

If transfer fails, the Ether payout will not occur, locking funds in the contract and potentially leading to player dissatisfaction.

Tools Used

  • Manual Review

  • Aderyn

Recommendations

Replace transfer with call for Ether transfers:

(bool success, ) = player.call{value: 2 ether}("");
require(success, "Ether transfer failed");
Updates

Lead Judging Commences

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.