use msg.sender rather than _msgSender() in FeeSplitter.receive #1
Labels
bug
Something isn't working
G (Gas Optimization)
sponsor confirmed
Sponsor agrees this is a problem and intends to fix it (OK to use w/ "disagree with severity")
Handle
TomFrench
Vulnerability details
Impact
Gas costs
Proof of Concept
In the
receive
function ofFeeSplitter
we check that the address sending ETH is the WETH contract:https://github.com/code-423n4/2021-11-nested/blob/5d113967cdf7c9ee29802e1ecb176c656386fe9b/contracts/FeeSplitter.sol#L74
As we can safely say that the WETH contract will never send a metatransaction, we can just use msg.sender and avoid the extra gas costs of
_msgSender()
Recommended Mitigation Steps
Replace
_msgSender()
withmsg.sender
The text was updated successfully, but these errors were encountered: