Omniscia Sovryn Audit
MultiSigWallet Manual Review Findings
MultiSigWallet Manual Review Findings
MSW-01M: Outdated Gas Stipend
| Type | Severity | Location |
|---|---|---|
| Logical Fault | Medium | MultiSigWallet.sol:L250 |
Description:
The external_call function subtracts a hardcoded value from the available gas for a particular call. This value is analyzed in the comments, however, it is outdated as EIP-2929 changed these gas costs and thus will cause the call to fail unless explicit storage access lists are provided along with the transaction.
Example:
sovryn-token-bridge/bridge/contracts/MultiSigWallet.sol
246assembly {247 let x := mload(0x40) // "Allocate" memory for output (0x40 is where "free memory" pointer is stored by convention)248 let d := add(data, 32) // First 32 bytes are the padded length of data, so exclude that249 result := call(250 sub(gas, 34710), // 34710 is the value that solidity is currently emitting251 // It includes callGas (700) + callVeryLow (3, to pay for SUB) + callValueTransferGas (9000) +252 // callNewAccountGas (25000, in case the destination address does not exist and needs creating)253 destination,254 value,255 d,256 dataLength, // Size of the input (in bytes) - this is what fixes the padding problem257 x,258 0 // Output is ignored, therefore the output size is zero259 )260}Recommendation:
We strongly recommend the linked EIP to be studied and the gas costs to be updated accordingly, ensuring that calls to the wallet will execute successfully regardless of whether storage access lists have been defined.
Alleviation:
The gas allocation of the assembly block was updated to a more up-to-date and EIP-encompassing one.