# address.transfer is used in the codebase, which could lead to stuck funds Crit/High · Three Sigma · Cross-chain bridge · 15th July, 2024 Finding 3S-OB-M02 of the Orange Bridge security review. - Protocol: https://www.orangeweb3.com/ - Report: /reports/orange - Source: https://cdn.sanity.io/files/qoqld077/production/686ad4e1d5035d69002f5f97e281e3c5a8b7ce00.pdf --- ### Description Using address.transfer is not recommended as future gas cost changes can make it no longer work or users might use smart contract wallets. The reason is that it only forwards 2300 gas, which can lead to the 2 problems mentioned before. ### Recommendation Use address.call{value: amount}("") instead, [here](https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/utils/Address.sol#L33) is an example implementation. If the gas usage of the target is a concern, [this](https://github.com/nomad-xyz/ExcessivelySafeCall/blob/main/src/ExcessivelySafeCall.sol#L24) implementation can be used instead, setting the _gas to some amount that may be changed and _maxCopy and _calldata to 0. ### Status Addressed in [#252ae5e](https://github.com/orangecryptohq/orange-bridge-contract/commit/252ae5e48951c4ca982acc8ea9f0dae555b33d34). --- Related findings: - [Use of `address.transfer` instead of the recommended `address.call{value: amount}("")`](https://0xsimao.com/findings/blast-ido-pools-transfer-recommended-call-value): Blast IDO Pools - [When changing addresses, use 2 step transfer and/or contract size and/or address 0x0 checks](https://0xsimao.com/findings/fuji-finance-changing-addresses-transfer-0x0): Fuji Finance - [_crossTransfer(...) reverts for smart contracts that don't share the same address on different chains](https://0xsimao.com/findings/fuji-finance-cross-transfer-reverts-share): Fuji Finance - [`PreDepositVault::sweep()` uses `address.transfer` which does not work for certain wallets](https://0xsimao.com/findings/gaib-deposit-sweep-transfer-wallets): GAIB Pre-Vaults