Skip to content
Request an audit

‹ Findings database

KeyringCoreV2Base::collectFees() should use Address::sendValue() instead of address.transfer()

Low/InfoKeyring Credentials audit·Three Sigma·Zero-knowledge compliance·10th July, 20243S-Keyring-L01

Description

address.transfer() hardcodes 2300 gas to forward, which may not be enough if gas costs change in the future or to is a smart contract wallet that does some logic in its receive()/fallback() function.

Recommendation

Use address::sendValue() from OpenZeppelin.

Status

Addressed in #ffe8b11.

Source

Disclosed by 0xSimao · Sherlock's 2025 Watson of the Year · 21 first places in 57 audit contests