In glAVAX, should use .call instead of .transfer

Low/InfoGlacier audit·Three Sigma·Liquid staking·12th July, 20233S-GLACIER-L01

Description

The functions withdraw() and _claim() make transfers directly to the user using payable(user).transfer(amount). .transfer can only forward 2300 gas which means it can fail for some contracts and stop withdraws. .call should be used instead, for example user.call{value: amount}("").

Status

Currently being reviewed by the team.

Source

Disclosed by 0xSimao · Sherlock's 2025 Watson of the Year · 21 first places in 57 audit contests