refund call don't check return success.

[c4-bot-7]

Lines of code

https://github.com/code-423n4/2024-01-decent/blob/d562762c3bf58cca7e24171873fb7b6fbfa7b2b5/src/UTBExecutor.sol#L54

Vulnerability details

Impact

refund call don't check return success, this may cause user to lose funds.

Proof of Concept

    function execute(
     address target,
        address paymentOperator,
        bytes memory payload,
        address token,
        uint amount,
        address payable refund,
        uint extraNative
    ) public onlyOwner {
        bool success;
        if (token == address(0)) {
            (success, ) = target.call{value: amount}(payload);
            if (!success) {
@>               (refund.call{value: amount}(""));
            }
            return;
        }

According to the code, only check the low level to target success or not but not check the refund call success or not. If the target call success but the refund call fail, the user will lose funds.

Tools Used

manual

Recommended Mitigation Steps

check low level call return value of refund call.

Assessed type

Invalid Validation

[c4-pre-sort]

raymondfam marked the issue as insufficient quality report

[c4-pre-sort]

raymondfam marked the issue as duplicate of #25

[c4-judge]

alex-ppg marked the issue as unsatisfactory:
Invalid