Beatland Festival
First Flight #44
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Impact: medium
Likelihood: medium
Invalid

Using transfer May Revert for Contracts Requiring More Than 2300 Gas

0xadwa

Description

The .transfer() method forwards only 2300 gas to the recipient. If target is a contract that requires more than 2300 gas to execute its fallback/receive function, the transfer will revert.
This can break compatibility with smart contract wallets (e.g., Gnosis Safe, multisigs, or contracts with logic in their receive/fallback).

function withdraw(address target) external onlyOwner {
payable(target).transfer(address(this).balance);
}

Risk

Medium: Funds could be locked in the contract if the owner tries to withdraw to a contract address that needs more than 2300 gas.

Recommended Mitigation

Use .call{value: ...}("") instead of .transfer()
This allows you to forward all available gas and handle the success/failure explicitly.

function withdraw(address target) external onlyOwner {
+ (bool success, ) = payable(target).call{value: address(this).balance}("");
require(success, "Withdraw failed");
}
Updates

Lead Judging Commences

inallhonesty Lead Judge about 2 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.