FairSide contest - JMukesh's results

Handle

JMukesh

Vulnerability details

Impact

Istanbul hardfork increases the gas cost of the SLOAD operation and therefore breaks some existing smart contracts.

In file withdrawable.sol, contract uses transfer() to send eth from contract to EOA due which eth can get stuck.

reason behind this is, after Istanbul hardfork ,any smart contract that uses transfer() or send() is taking a hard dependency on gas costs by forwarding a fixed amount of gas: 2300. This forwards 2300 gas, which may not be enough if the recipient is a contract and gas costs change.

Proof of Concept

https://github.com/code-423n4/2021-05-fairside/blob/main/contracts/dependencies/Withdrawable.sol#L18

https://consensys.net/diligence/blog/2019/09/stop-using-soliditys-transfer-now/

Tools Used

manual review

Recommended Mitigation Steps

use call() to send eth