# Native transfers should use Openzeppelin's .sendValue() Low/Info · Three Sigma · Modular blockchain infrastructure · 27th January 2024 Finding 3S-TR-L03 of the Trestle wTIA Bridge security review. - Report: /reports/trestle-wtia-bridge - Source: https://github.com/0xsimao/audits/blob/main/Three%20Sigma/2024-01-27-trestle.pdf --- ### Description Paying fees to the marketing operator uses [.transfer()](https://github.com/TrestleProtocol/Audit-Contracts/blob/main/src/Trestle.sol#L291), which only forwards 2300 gas, which could lead to reverts if the operator has any logic in the fallback or receive functions. ### Recommendation Use [.sendValue()](https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/utils/Address.sol#L41) from Openzeppelin's Address.sol. ### Status Acknowledged. Disclosed by 0xSimao (https://0xsimao.com/). --- Related findings: - [KeyringCoreV2Base::collectFees() should use Address::sendValue() instead of address.transfer()](https://0xsimao.com/findings/keyring-ii-keyring-fees-send-transfer): Keyring Credentials