# `PreDepositVault::sweep()` uses `address.transfer` which does not work for certain wallets Low/Info · Sherlock · AI compute financing · 28th March, 2025 Finding L-4 of the GAIB Pre-Vaults security review. - Protocol: https://gaib.ai/ - Report: /reports/gaib - Source: https://4221781861-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FLXNTW9blcTeiKZrMFhab%2Fuploads%2FQMsETA4dRNo2auiUSeOX%2FAIDa%20Vault%20Audit_20250411.pdf?alt=media&token=5e2f84ea-9698-4fa7-81ef-503771d234aa --- ## Summary `address.transfer` forwards at most 2300 gas, which means it does not work for some smart contract wallets. ## Vulnerability Detail Admin calls `PreDepositVault::sweep()` using a smart contract wallet but it reverts trying to transfer native out. ## Impact Admin can't sweep ETH. ## Code Snippet https://github.com/sherlock-audit/2025-03-gaib/blob/main/pre-vaults/contracts/pre-vaults/gpdWBTC.sol#L89 ## Tool Used Manual Review ## Recommendation Use `sendValue()` https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/utils/Address.sol#L33. --- Related findings: - [Limitations for Users Employing Multi-sig or Account Abstraction Wallets in Setting Delegate Address](https://0xsimao.com/findings/ostium-limitations-employing-abstraction-delegate): Ostium - [Some view functions will not work under certain conditions](https://0xsimao.com/findings/beraborrow-i-view-work-certain-conditions): Beraborrow Managed Dens - [`FlashRolloverLoan_G5` will not work for certain tokens due to not setting the approval to `0` after repaying a loan](https://0xsimao.com/findings/teller-finance-flash-rollover-approval-repaying): Teller Finance - [`Market::liquidate()` will not work when most of the liquidity is borrowed due to wrong liquidator `transferFrom()` order](https://0xsimao.com/findings/exactly-protocol-update-staking-contract-liquidate-borrowed-liquidator-transfer): Exactly Protocol Update - Staking Contract