Skip to content
Request an audit

‹ All findings

address.transfer is used in the codebase, which could lead to stuck funds

Crit/HighOrange Bridge·Three Sigma · Cross-chain bridge · 15th July, 20243S-OB-M02

Description

Using address.transfer is not recommended as future gas cost changes can make it no longer work or users might use smart contract wallets. The reason is that it only forwards 2300 gas, which can lead to the 2 problems mentioned before.

Recommendation

Use address.call{value: amount}("") instead, here is an example implementation.

If the gas usage of the target is a concern, this implementation can be used instead, setting the _gas to some amount that may be changed and _maxCopy and _calldata to 0.

Status

Addressed in #252ae5e.