# Use of `address.transfer` instead of the recommended `address.call{value: amount}("")` Low/Info · Three Sigma · IDO launchpad · 7th August, 2024 Finding L-3 of the Blast IDO Pools security review. - Protocol: https://docs.blastup.io/blastup-docs - Report: /reports/blast-ido-pools - Source: https://cdn.sanity.io/files/qoqld077/production/d2a7ca81740e715b604122c12dafbce599e43f2f.pdf --- ### Description `address.transfer` is unsafe and may lead to stuck tokens as it forwards 2300 gas, which may run out of gas in the fallback function of the receiver. Additionally, future opcode changes could make it stop working. ### Recommendation Use `address.call{value: amount}("")`. Keep in mind that state changes must be performed before sending the funds this way as it opens the door for reentrancy. In `IDOPoolAbstract::claimRefund()`, funds are sent before deleting the position, which would be exploitable. --- Related findings: - [KeyringCoreV2Base::collectFees() should use Address::sendValue() instead of address.transfer()](https://0xsimao.com/findings/keyring-ii-keyring-fees-send-transfer): Keyring Credentials - [Stuck ETH in Curve exchanges due to sending msg.value to the exchange instead of amountIn](https://0xsimao.com/findings/singularity-stuck-eth-curve-exchanges): Singularity - [In glAVAX, should use .call instead of .transfer](https://0xsimao.com/findings/glacier-avax-call-instead-transfer): Glacier - [Using transfer() instead of call() may revert](https://0xsimao.com/findings/ostium-transfer-instead-call-revert): Ostium