Good Entry - parsely's results

Lines of code

https://github.com/code-423n4/2023-08-goodentry/blob/main/contracts/helper/V3Proxy.sol#L147-L158 https://github.com/code-423n4/2023-08-goodentry/blob/main/contracts/helper/V3Proxy.sol#L160-L176 https://github.com/code-423n4/2023-08-goodentry/blob/main/contracts/helper/V3Proxy.sol#L178-L194

Vulnerability details

Impact

Although this is similar to known findings M-14 (link to known findings M-14) , M-14 refers to a different contract (GeVault.sol), only has one instance indicated which is in that contract, and does not actually reference the .call function but the .deposit function of WETH. The return value from the low-level calls to return any funds to the msg.sender after the swap function is not checked and can lead to loss of funds for the msg.sender if the call fails.

payable(msg.sender).call{value: amountOut}("");

Tools Used

Manual Audit

Recommended Mitigation Steps

Check for success on the call.

(bool success,) = payable(msg.sender).call{value: amountOut}("");
require(success, "Return of funds failed");

Assessed type

call/delegatecall