Submission Details
Severity:
use of "transfer" opcode to send ETH
Vulnerability Details
in chirstmasDinner::_refundETH the .transfer opcode is used to handle ETH transfer, it does this by forwarding a fixed amount of 2300 gas. This is dangerous because
If the recipient is a a multisig safe, with a
receive/fallbackfunction which requires >2300 gas, e.g safes that execute extra logic in thereceive/fallbackfunction, the transfer function will always fail for them due to out of gas errors.
Impact
christamsDinner::refundfunction will always revert and user can't refund his deposit
Tools Used
IDE
Manual Review
Recommendations
Use the ".call" opcode instead and follow CEI pattern
Updates
Lead Judging Commences
0xtimefliez 10 months ago
Submission Judgement Published Assigned finding tags:
transfer instead of call
Rewards breakdown
nSLOC
129This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.