Lines of code

Vulnerability details

Impact

The _claim() function is called to claim a reward for a given _rewardIdentifier. The leaf node is calculated using the hashed _index, _account and _amount values and is verified to belong to the merkle tree. After setting the reward as claimed, the tokens are transferred to the _account. However, if _account receives native ETH and is a contract, it is likely that the call to _claim() will fail due to insufficient gas. If the user fails to implement the fallback/receive function or the gas used exceeds the 2300 gas supplied by the transfer() function, the user will be unable to claim their ETH.

#Proof of Concept
<https://consensys.net/diligence/blog/2019/09/stop-using-soliditys-transfer-now/&gt;

Tools Used

Manual code review.

Recommended Mitigation Steps

Consider using the low level call() function with the value _amount parsed to it. This will forward any available gas to the contract call. As claim() already has the nonReentrant modifier, this shouldn’t raise any concerns about reentrancy attacks.

The text was updated successfully, but these errors were encountered:

All reactions