Submission Details
Severity:
Use of transfer() function may cause refunds to fail
Summary
The contract uses the transfer() function for ETH refunds, which forwards only 2,300 gas. This hard-coded gas limit can cause refunds to fail if the receiving address is a contract with complex logic in its receive function.
Vulnerability Details
The _refundETH function uses the transfer() method:
ChristmasDinner.sol#L235
function _refundETH(address payable _to) internal {
uint256 refundValue = etherBalance[_to];
_to.transfer(refundValue);
etherBalance[_to] = 0;
}
Impact
ETH refunds may fail for contract addresses
Tools Used
Manual code review
Performing formal verification with Quint
Recommendations
Replace transfer() with the recommended call() pattern
Updates
Lead Judging Commences
0xtimefliez about 1 year ago
Submission Judgement Published Assigned finding tags:
transfer instead of call
Rewards breakdown
nSLOC
129This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.