Christmas Dinner

Summary

Vulnerability Details

The _refundETH function uses .transfer() to send Ether, which imposes a fixed gas limit. If the recipient is a contract with a fallback function requiring more gas, the transfer will fail, potentially locking funds.

Impact

Legitimate users may be unable to withdraw their Ether contributions if they interact through a smart contract wallet.

Tools Used

manual review

Recommendations

Replace .transfer() with .call{value: amount} to avoid gas issues and check the success of the call.

function _refundETH(address payable _to) internal {
uint256 refundValue = etherBalance[_to];
etherBalance[_to] = 0; // Reset before transfer to prevent reentrancy
(bool success, ) = _to.call{value: refundValue}("");
require(success, "Ether transfer failed");
}