Escher contest - Awesome's results

Lines of code

https://github.com/code-423n4/2022-12-escher/blob/main/src/minters/LPDA.sol#L105

Vulnerability details

Impact

Using payable.transfer() is not recommended because it can lead to the locking of funds.

The transfer() call requires that the recipient has a payable callback, and only provides 2300 gas for its operation. This means the following cases can cause the transfer to fail:

• The contract does not have a payable callback

• The contract's payable callback spends more than 2300 gas (which is only enough to emit something)

• The contract is called through a proxy which itself uses up the 2300 gas

If a user falls into one of the above categories, they'll be unable to receive funds from the vault in a migration wrapper.

Proof of Concept

src/minters/LPDA.sol#L105

Line 105:  payable(msg.sender).transfer(owed);

As we can see line 105 uses payable.transfer()

References

Stop Using Solidity's transfer() Now

Recommended Mitigation Steps

Use address.call{value:x}() instead