0xeix - No check if transfer() operation was successful in FootiumEscrow.sol

[sherlock-admin]

0xeix

medium

No check if transfer() operation was successful in FootiumEscrow.sol

Summary

There is no check provided for transfer() function to check if this operation was successful.

Vulnerability Detail

If transfer() opcode costs more than 2300 gas it will be reverted. And when you use it to send to a smart contract, the chances are it will cost more and it's considered a bug to use it.

Impact

Medium-risk vulnerability.

Code Snippet

https://github.com/sherlock-audit/2023-04-footium/blob/main/footium-eth-shareable/contracts/FootiumEscrow.sol#L110

Tool used

Manual Review

Recommendation

It's better to use low-level calls that don't revert on failure but instead return a boolean value that can be checked. And it's better to use safeTransfer() implementation of transfer() because there some weird ERC20 tokens that can behave unexpectedly.

Duplicate of #86