Escher contest - Rahoz's results

Lines of code

https://github.com/code-423n4/2022-12-escher/blob/5d8be6aa0e8634fdb2f328b99076b0d05fefab73/src/minters/FixedPrice.sol#L109 https://github.com/code-423n4/2022-12-escher/blob/5d8be6aa0e8634fdb2f328b99076b0d05fefab73/src/minters/OpenEdition.sol#L92 https://github.com/code-423n4/2022-12-escher/blob/5d8be6aa0e8634fdb2f328b99076b0d05fefab73/src/minters/LPDA.sol#L85

Vulnerability details

Impact

In three contracts FixedPrice, LPDA and OpenEdition, when contract finish sale and transfer some amount to feeReceiver then if feeReceiver is a contract which contain logic inside fallback function, it can be fail the execution because .transfer() hardcode 2300 gas limit. Also can be fail when transfer to saleReceiver in LPDA

Proof of Concept

https://github.com/code-423n4/2022-12-escher/blob/5d8be6aa0e8634fdb2f328b99076b0d05fefab73/src/minters/FixedPrice.sol#L109 https://github.com/code-423n4/2022-12-escher/blob/5d8be6aa0e8634fdb2f328b99076b0d05fefab73/src/minters/OpenEdition.sol#L92 https://github.com/code-423n4/2022-12-escher/blob/5d8be6aa0e8634fdb2f328b99076b0d05fefab73/src/minters/LPDA.sol#L85

Recommended Mitigation Steps

Consider to use .call and check transaction is success or not.

(bool success,) = ISaleFactory(factory).feeReceiver().call{value: address(this).balance / 20}("");
require(success, "Transfer error");

// Contract LDPA with function buy
function buy(uint256 _amount) external payable {
    ...
    if (newId == temp.finalId) {
        sale.finalPrice = uint80(price);
        uint256 totalSale = price * amountSold;
        uint256 fee = totalSale / 20;
				(bool success1,) = ISaleFactory(factory).feeReceiver().call{value: fee}("");
				require(success1, "Transfer error");
				(bool success2,) = temp.saleReceiver.call{value: totalSale - fee}("");
				require(success2, "Transfer error");
        _end();
    }
}