Lack of success check for low level call could make swapAndExecute(...) function fail silently

[c4-bot-7]

Lines of code

https://github.com/code-423n4/2024-01-decent/blob/011f62059f3a0b1f3577c8ccd1140f0cf3e7bb29/src/UTBExecutor.sol#L70

Vulnerability details

Impact

Loss of funds to the user

Scenario

1. Alice calls swapAndExecute to execute a transaction with 1000 ERC20 tokens
2. The target contract is takes the ERC20 token but the transaction fails
3. Because the returned bool value is not checked, the transaction did not revert causing user to lose the 1000 ERC20 tokens.

Proof of Concept

The UTBExecutor.excute(...) function is used to execute calls in the UTB.sol#swapAndExecute(...) function.

In a situation where the call on line 70 fails, the transaction may will not revert because the boolean returned value was asigned but not checked to revert if it's false.

File: UTBExecutor.sol
function execute(
        address target,
        address paymentOperator,
        bytes memory payload,
        address token,
        uint amount,
        address payable refund,
        uint extraNative
    ) public onlyOwner {
        bool success;
        if (token == address(0)) {
            (success, ) = target.call{value: amount}(payload);
            if (!success) {
                (refund.call{value: amount}(""));
            }
            return;
        }

        uint initBalance = IERC20(token).balanceOf(address(this));

        IERC20(token).transferFrom(msg.sender, address(this), amount);
        IERC20(token).approve(paymentOperator, amount);

        if (extraNative > 0) {
            (success, ) = target.call{value: extraNative}(payload);
            if (!success) {
                (refund.call{value: extraNative}(""));//@audit revert early.
            }
        } else {
@>            (success, ) = target.call(payload);//@audit success not checked.
        }

        uint remainingBalance = IERC20(token).balanceOf(address(this)) -
            initBalance;

        if (remainingBalance == 0) {
            return;
        }

        IERC20(token).transfer(refund, remainingBalance);
    }

Tools Used

Manual review

Recommended Mitigation Steps

Consider checking the returned bool value from an address.call

(success, ) = target.call(payload);
require(success, "execution failed");

Assessed type

call/delegatecall

[c4-pre-sort]

raymondfam marked the issue as insufficient quality report

[c4-pre-sort]

raymondfam marked the issue as duplicate of #70

[c4-judge]

alex-ppg marked the issue as not a duplicate

[c4-judge]

alex-ppg marked the issue as duplicate of #641

[c4-judge]

alex-ppg marked the issue as unsatisfactory:
Invalid