Golom contest - bearonbike's results

Lines of code

https://github.com/code-423n4/2022-07-golom/blob/e5efa8f9d6dda92a90b8b2c4902320acf0c26816/contracts/core/GolomTrader.sol#L154

Vulnerability details

Impact

Use deprecated transfer() may cause revert.

Proof of Concept

Transfer() used to send ether with 2300 limited gas. If payAddress is a contract, and it's fallback()/receive() function use more than 2300 gas, the transaction will revert.

fallback() external payable {
    // Do something that use more than 2300 gas.
}
    

A blog explain this: https://consensys.net/diligence/blog/2019/09/stop-using-soliditys-transfer-now/

Tools Used

Vscode

Recommended Mitigation Steps

Use call instead, for example:

function payEther(uint256 payAmt, address payAddress) internal {
    if (payAmt > 0) {
        // if royalty has to be paid
        (bool success, ) = payAddress.call{value:payAmt}("");
        require(success, "Transfer failed.");
    }
}