Missing ETH call success check -> . ETH may not successfully transfer out and get stuck in the UTBExecutor contract.

[c4-bot-7]

Lines of code

https://github.com/code-423n4/2024-01-decent/blob/main/src/UTBExecutor.sol#L64-L68

Vulnerability details

Impact

ETH may not successfully transfer out and get stuck in the UTBExecutor contract, precisely in the execute function.

Proof of Concept

In the execute function, when extraNative > 0 the function tries to transfer ETH to the target and if not succeed, then it tries to transfer ETH to the refund address instead. However, the second transfer to the refund address does not check for transfer success (missing require(success)). This means that the ETH that was supposed to send to the refund address may not be successfully transferred.

This can easily happen when the refund address is a contract and did not implement the fallback/receive function properly.

Tools Used

Manual Review

Recommended Mitigation Steps

• Add require(success) check after ETH transfer attempt to the refund address.

Assessed type

ETH-Transfer

[c4-pre-sort]

raymondfam marked the issue as insufficient quality report

[c4-pre-sort]

raymondfam marked the issue as duplicate of #25

[c4-judge]

alex-ppg marked the issue as unsatisfactory:
Invalid