Debt DAO contest - bananasboys's results

Lines of code

https://github.com/debtdao/Line-of-Credit/blob/audit/code4rena-2022-11-03/contracts/utils/LineLib.sol#L48

Vulnerability details

Impact

Potential impossibility to work with smart contracts wallets or any kind of contract with custom logic in the fallback function.

The usage of the transfer function for ETH transfers is not recommended, because it reverts on failure and it only forwards a gas stipend of 2300 gas units. If the recipient is an EOA is not a problem. However, the recipient could be any sort of contract (such as multisig or a smart contract wallet) with custom logic within the fallback function that could spend more than the given gas stipend, making the call fail.

Steps to reproduce

1. Create a contract with custom logic that spends more than 2300 gas units to the fallback function.
2. Use the contract to interact with the contract to lend/borrow ETH.
3. The execution will revert when a transfer of ETH occurs.

Recommended Mitigation Steps

Two alternatives:

1. Use the low-level call function. Solidity docs: https://docs.soliditylang.org/en/v0.8.17/security-considerations.html?highlight=call%20ether#sending-and-receiving-ether)
2. Use the openzeppelin Address library. Function to use: https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/utils/Address.sol#L60