mediumLogic errorEVM-Solidity
PoolTogether: The Prize Layer for DeFi: Potential ETH Loss Due to transfer Usage in Requestor Contract on `zkSync`
- Payout
- $0
- Protocol
- PoolTogether: The Prize Layer for DeFi
- Disclosed
- Jun 6, 2024
- Source
- sherlock
PoolTogether's pt-v5-rng-witnet integration withdraws stranded ETH to draw bots through Requestor.withdraw(), which uses Solidity's low-gas `.transfer()` (2300 stipend). On zkSync Era, the fixed stipend is insufficient even for plain EOA transfers because of t …
Similar reports
- No close matches yet.
References
This report is already public and closed. Coin Buggie never publishes active or unpatched vulnerability data.