Missing checks on low-level call

[c4-bot-4]

Lines of code

https://github.com/code-423n4/2024-01-decent/blob/011f62059f3a0b1f3577c8ccd1140f0cf3e7bb29/src/UTBExecutor.sol#L70

Vulnerability details

Impact

on UTBExecutor.sol file the execute function has low-level call function as follow ( L64 - L71):

  if (extraNative > 0) {
            (success, ) = target.call{value: extraNative}(payload);
            if (!success) {
                (refund.call{value: extraNative}(""));
            }
        } else {
            (success, ) = target.call(payload);
        }

as you see there are no checks to ensure (success, ) = target.call(payload);

According to the Solidity docs :

"The low-level functions call, delegatecall and staticcall return true as their first return value if the account called is non-existent, as part of the design of the EVM. Account existence must be checked prior to calling if needed".

As a result, it is possible that this call will fail and It may be end with fund loses.

Proof of Concept

https://github.com/code-423n4/2024-01-decent/blob/011f62059f3a0b1f3577c8ccd1140f0cf3e7bb29/src/UTBExecutor.sol#L70

Tools Used

Manual review

Recommended Mitigation Steps

consider to adding logic after L70

if (!success) {
                // handle the false return
            }



## Assessed type

Invalid Validation

[c4-pre-sort]

raymondfam marked the issue as insufficient quality report

[c4-pre-sort]

raymondfam marked the issue as duplicate of #70

[c4-judge]

alex-ppg marked the issue as not a duplicate

[c4-judge]

alex-ppg marked the issue as duplicate of #641

[c4-judge]

alex-ppg marked the issue as unsatisfactory:
Invalid