# In glAVAX, should use .call instead of .transfer Low/Info · Three Sigma · Liquid staking · 12th July, 2023 Finding 3S-GLACIER-L01 of the Glacier security review. - Protocol: https://www.glacier.io/ - Report: /reports/glacier - Source: https://cdn.sanity.io/files/qoqld077/production/21bd3b6fa78c55968a6c9c7ea4fd49f34a8bd3d8.pdf --- ### Description The functions [withdraw()](https://github.com/JackFrostDev/glacier-contracts/blob/main/contracts/protocol/GlacialAVAX/glAVAX.sol#L252) and [_claim()](https://github.com/JackFrostDev/glacier-contracts/blob/main/contracts/protocol/GlacialAVAX/glAVAX.sol#L687) make transfers directly to the user using payable(user).transfer(amount). .transfer can only forward 2300 gas which means it can fail for some contracts and stop withdraws. .call should be used instead, for example user.call{value: amount}(""). ### Status Currently being reviewed by the team. --- Related findings: - [Use of `address.transfer` instead of the recommended `address.call{value: amount}("")`](https://0xsimao.com/findings/blast-ido-pools-transfer-recommended-call-value): Blast IDO Pools - [Using transfer() instead of call() may revert](https://0xsimao.com/findings/ostium-transfer-instead-call-revert): Ostium - [Initializable constracts should call _disableInitializers() in the constructor instead of using the initializer modifier](https://0xsimao.com/findings/mitosis-initializable-constracts-initializers-initializer): Mitosis - [KeyringCoreV2Base::collectFees() should use Address::sendValue() instead of address.transfer()](https://0xsimao.com/findings/keyring-ii-keyring-fees-send-transfer): Keyring Credentials