Good Entry - MatricksDeCoder's results

Lines of code

https://github.com/code-423n4/2023-08-goodentry/blob/71c0c0eca8af957202ccdbf5ce2f2a514ffe2e24/contracts/helper/V3Proxy.sol#L156 https://github.com/code-423n4/2023-08-goodentry/blob/71c0c0eca8af957202ccdbf5ce2f2a514ffe2e24/contracts/helper/V3Proxy.sol#L192

Vulnerability details

Impact

Unchecked return values from low levels calls using ".call" to send ether can fail when sending ETH. If the result is not checked it implies ETH can be locked in the contract.

Proof of Concept

V3Proxy.sol line 156 -> payable(msg.sender).call{value: amountOut}(""); - ignores return values V3Proxy.sol line 192 -> payable(msg.sender).call{value: amounts[1]}(""); - ignores return values above all missing check (bool success, bytes memory data) See previous Code4rena Audit Reports Medium Vulnerability

Tools Used

Manual Analysis

Recommended Mitigation Steps

It is recommended to check return values for all low level calls. If the low level is used to prevent blocking operations, consider logging failed calls.

(bool success, bytes memory data) = payable(msg.sender).call{value: amountOut}("");
if(!success) { //do something e.g revert etc }
// can also further check or do something with returned data 

Assessed type

call/delegatecall