Use call instead of transfer

[code423n4]

Lines of code

https://github.com/holographxyz/holograph-protocol/blob/c4_audit/contracts/enforcer/PA1D.sol#L396

Vulnerability details

Impact

The transfer function is not recommended for sending ETH due to its 2300 gas unit limit. Instead call can be used to circumvent the gas limit

Proof of Concept

1. Observe the _payoutEth function

  function _payoutEth() private {
...

    // uint256 sent;
    for (uint256 i = 0; i < length; i++) {
      sending = ((bps[i] * balance) / 10000);
      addresses[i].transfer(sending);
      // sent = sent + sending;
    }
  }

2. Observe that contract is using transfer function for sending eth to addresses[i] where addresses[i] might be a contract requiring more than 2300 gas unit in which case this function will fail

Recommended Mitigation Steps

Use call instead of transfer

[d3e4]

Duplicate of #452

[alexanderattar]

transfer was used intentionally, but this function will be refactored anyways due to other issues with gas calculation

[gzeoneth]

Consider with #36