# `uniTransfer()` limits the gas limit to 5k in outdated 1inch solidity-utils lib Low/Info · Sherlock · DEX aggregator · 14th April, 2025 Finding L-2 of the 1inch Fee Extension security review. - Protocol: https://1inch.com/ - Report: /reports/1inch - Source: https://github.com/1inch/1inch-audits/blob/master/Fees%20for%20LO%20and%20Fusion%20V1/Fee%20flow%20v1-Sherlock.pdf --- ## Summary `UniERC20::uniTransfer()` limits the gas to 5k in the solidity-utils lib version 6.3.0. ## Vulnerability Detail See the version used in the current commit of the protocol [here](https://github.com/1inch/solidity-utils/blob/26969f67e5ee32ad70d07ed1c3a8066ed2ede5e1/contracts/libraries/UniERC20.sol#L69). The solidity-utils lib has been updated in 6.4.0 and now forwards all gas, which means that the only fix needed is bumping this version in the package.json file. ## Impact Sweeping could fail due to this limitation. Another owner would have to be used, that most likely can not be a multisig so it could be a problem. ## Code Snippet https://github.com/sherlock-audit/2025-04-1inch/blob/main/limit-order-protocol/contracts/extensions/FeeTaker.sol#L97-L99 ## Tool Used Manual Review ## Recommendation Bump the solidity utils version to the latest. --- Related findings: - [Erc20Utils::safeTransferFrom() assumes the tokens are transferred to this, which may not be the case](https://0xsimao.com/findings/districtone-erc20-utils-transfer-transferred): DistrictOne - [It's possible to borrow, redeem, transfer tokens and exit markets with outdated collateral prices and borrow interest](https://0xsimao.com/findings/venus-protocol-isolated-pools-borrow-redeem-collateral-interest): Venus Protocol Isolated Pools - [genesisLimit can be placed as constant variables to save gas.](https://0xsimao.com/findings/metazero-i-genesis-placed-constant-gas): MetaZero Omnichain NFTs - [Send should revert if the gas limit has not been set for a destination chain (peer)](https://0xsimao.com/findings/metazero-i-revert-gas-destination-peer): MetaZero Omnichain NFTs