Vulnerability Details

The onCall function refunds gas using payable(sender).call. This refund mechanism is prone to failure, potentially leading to denial-of-service conditions.

Related CVE:
CVE-2024-44445: This issue involved state manipulation attacks in a BSC smart contract, where attackers could inflate token balances, leading to increased profits without cost.

Analysis

The vulnerable implementation

(bool success, ) = payable(sender).call{value: gasAmount}("");
if (!success) revert GasTokenTransferFailed();

• The refund depends on successful execution of the external call.
• Failure due to gas limits or recipient-side issues will halt execution.

How It Can Be Harmful

• DoS Risks: Failed refunds can block execution.
• Unexpected Behavior: Dependence on recipient’s external logic introduces risks of unforeseen failures.

PoC Code

Simulate a refund failure by sending funds to a contract with a rejecting fallback:

contract RejectRefund {
    fallback() external payable {
        revert();
    }
}

How to Mitigate the Issue

1. Graceful Handling:
   Log refund failures instead of reverting:

   if (!success) emit RefundFailed(sender, gasAmount);

2. Avoid Refunds:
   Remove the refund mechanism entirely to simplify contract logic.

References

• SWC-128: DoS with Block Gas Limit: Discusses how unbounded gas usage can lead to contract failures.
  • SWC Registry - SWC-128
• Ethereum Yellow Paper: Explains gas refund mechanics and their pitfalls.
  • Ethereum Yellow Paper
• CVE-2024-45719: Highlights vulnerabilities caused by failed external calls and their effect on contract behavior.
  • CVE Details - CVE-2024-45719