Canto contest - nxrblsrpr's results

Execution layer for original work.

General Information

Platform: Code4rena

Start Date: 14/06/2022

Pot Size: $100,000 USDC

Total HM: 26

Participants: 59

Period: 7 days

Judge: GalloDaSballo

Total Solo HM: 9

Id: 133

League: ETH

Canto

Findings Distribution

Researcher Performance

Rank: 50/59

Findings: 1

Award: $183.51

🌟 Selected for report: 0

πŸš€ Solo Findings: 0

Awards

72.3997 USDC - $72.40

687.9945 CANTO - $111.11

Labels

bug
QA (Quality Assurance)

External Links

Lines of code

https://github.com/Plex-Engineer/lending-market/blob/755424c1f9ab3f9f0408443e6606f94e4f08a990/contracts/WETH.sol#L31

Vulnerability details

Impact

The use of the deprecated transfer() function for an address will cause the transaction to fail when: The claimer contract does not implement a payable function. The claimer contract does implement a payable fallback which uses more than 2300 gas. The claimer contract implements a payable fallback function that needs less than 2300 gas but is called through proxy, raising the call’s gas usage above 2300.

Proof of Concept

https://github.com/Plex-Engineer/lending-market/blob/755424c1f9ab3f9f0408443e6606f94e4f08a990/contracts/WETH.sol#L31

Tools Used

Manual Review

Use call() instead of transfer()

#0 - nivasan1

2022-06-22T22:43:18Z

duplicate of #14

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax Β© 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter