Return value of call() in UTBExecutor is not checked causing loss of funds

[c4-bot-5]

Lines of code

https://github.com/code-423n4/2024-01-decent/blob/011f62059f3a0b1f3577c8ccd1140f0cf3e7bb29/src/UTBExecutor.sol#L41

Vulnerability details

Impact

Currently in the UTBExecutor.sol contract, there are two instances where the return value of call is not checked. In the first instance, this would lead to complete loss of output tokens received from the swap. In the second instance, this would break any external application changes that were supposed to be made by calling the payload.

Proof of Concept

Both instances exist in the execute() function.

First instance:

• Assume both the target and refund address are the same address.
• On Line 53, if the call to the target reverts, we enter the if block on Line 54.
• On Line 55, since refund is the same address as target, the call reverts there as well. The issue here is that the return value of call made to the refund address is not checked, which allows further execution of the contract. i.e. we return early. This would cause permanent loss of funds for the user.

File: UTBExecutor.sol
50:         bool success;
51:         if (token == address(0)) {
53:             (success, ) = target.call{value: amount}(payload);
54:             if (!success) {
55:                 (refund.call{value: amount}(""));
56:             }
57:             return;
58:         }

Second instance:

• On line 75, the return value is cached but it is not checked to be true or false. Due to this if the call fails, this could break any external application changes that were supposed to be made by calling the payload.

File: UTBExecutor.sol
73:         } else {
74:             
75:             (success, ) = target.call(payload);
76:         }

Tools Used

Manual Review

Recommended Mitigation Steps

Check the return value of call() by wrapping it around a require statement.

Assessed type

Error

[c4-pre-sort]

raymondfam marked the issue as insufficient quality report

[c4-pre-sort]

raymondfam marked the issue as duplicate of #25

[c4-judge]

alex-ppg marked the issue as unsatisfactory:
Invalid