Skip to content
Request an audit

‹ Findings database

PreDepositVault::sweep() uses address.transfer which does not work for certain wallets

Low/InfoGAIB Pre-Vaults audit·Sherlock·AI compute financing·28th March, 2025·by 0xSimaoL-4

Summary

address.transfer forwards at most 2300 gas, which means it does not work for some smart contract wallets.

Vulnerability Detail

Admin calls PreDepositVault::sweep() using a smart contract wallet but it reverts trying to transfer native out.

Impact

Admin can't sweep ETH.

Code Snippet

https://github.com/sherlock-audit/2025-03-gaib/blob/main/pre-vaults/contracts/pre-vaults/gpdWBTC.sol#L89

Tool Used

Manual Review

Recommendation

Use sendValue() https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/utils/Address.sol#L33.