Christmas Dinner
First Flight #31
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Refund failure due to gas limit restrictions

yoanyjd

Summary

The transfer() function in the _refundETH method may fail when the recipient is a contract due to the gas limit restriction imposed by Ethereum, which could prevent the user from receiving their funds.

Vulnerability Details

When attempting to transfer Ether to a contract, the transfer() method only provides 2300 gas, which is sufficient for simple transfers but may not be enough for contracts with more complex logic in their receive() or fallback() functions. As a result, this could lead to failed refunds for contracts and the inability for users to claim their Ether.

function _refundETH(address payable _to) internal {
uint256 refundValue = etherBalance[_to];
_to.transfer(refundValue); // wrongly trying to send ETH
etherBalance[_to] = 0;
}

Impact

If the recipient is a contract, the transaction may fail due to insufficient gas, meaning that the user will not receive their refund. This can prevent users from accessing the funds they are entitled to, potentially leading to dissatisfaction and loss of trust in the platform.

Tools Used

Manual code review

Recommendations

To avoid this issue, it's recommended to use the call method instead of transfer to send Ether, as it allows more gas to be provided for the transaction and following the CEI pattern

function _refundETH(address payable _to) internal {
uint256 refundValue = etherBalance[_to];
etherBalance[_to] = 0;
// Transfering the Eth
(bool success, ) = _to.call{value: refundValue}("");
require(success, "Refund failed");
}
​
Updates

Lead Judging Commences

0xtimefliez Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

transfer instead of call

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!