Fractional v2 contest - hake's results

Lines of code

https://github.com/code-423n4/2022-07-fractional/blob/8f2697ae727c60c93ea47276f8fa128369abfe51/src/modules/Migration.sol#L172-L173

Vulnerability details

Impact

It might be impossible for some addresses to receive ETH via transfer() because receiver address might have methods that exceed 2300 gas, ultimately leading to frozen funds.

Proof of Concept

Native transfer() function has a limit of 2300 gas, which might not be enough when the receiving end has gas expensive operations, leading the transaction to revert.

https://github.com/code-423n4/2022-07-fractional/blob/8f2697ae727c60c93ea47276f8fa128369abfe51/src/modules/Migration.sol#L172-L173

        payable(msg.sender).transfer(ethAmount);

Tools Used

Manual Review

Recommended Mitigation Steps

Use call() instead of transfer() and make sure to implement a boolean return check on call()

Other instance: https://github.com/code-423n4/2022-07-fractional/blob/8f2697ae727c60c93ea47276f8fa128369abfe51/src/modules/Migration.sol#L325-L326

Lines of code

https://github.com/code-423n4/2022-07-fractional/blob/8f2697ae727c60c93ea47276f8fa128369abfe51/src/utils/SafeSend.sol#L30-L35

Vulnerability details

Impact

Funds might be automatically frozen via _sendEthOrWeth().

Proof of Concept

buyFractions() does not provide the option to pay with WETH, therefore the receiving address of sellFractions() wouldn't expect to receive WETH instead of ETH.

If for some unexpected reason the native ETH transfer fails, WETH will be sent to the receiver that might not be able to handle ERC20s, leading to the funds being frozen.

https://github.com/code-423n4/2022-07-fractional/blob/8f2697ae727c60c93ea47276f8fa128369abfe51/src/utils/SafeSend.sol#L30-L35

    function _sendEthOrWeth(address _to, uint256 _value) internal {
        if (!_attemptETHTransfer(_to, _value)) {
            WETH(WETH_ADDRESS).deposit{value: _value}();
            WETH(WETH_ADDRESS).transfer(_to, _value);
        }
    }

Tools Used

Manual Review

Recommended Mitigation Steps

Simply revert if native ETH transfer is not successful instead of attempting WETH transfer.

Other instance: https://github.com/code-423n4/2022-07-fractional/blob/8f2697ae727c60c93ea47276f8fa128369abfe51/src/modules/Buyout.sol#L235-L236