Skip to content

transfer()/send() 2300-Gas Stipend

SAFE-0143 External Calls Checked automatically by the scanner
1

What goes wrong

Ether is sent with .transfer() or .send(), which forward only 2300 gas. Recipients that are smart-contract wallets (multisigs, account-abstraction, proxies) often need more gas in their receive hook, so payments to them revert — breaking withdrawals for a growing class of users.

2

The vulnerable pattern

proof of concept — how it is exploited
// payable(user).transfer(amount);
// user is a Gnosis Safe whose receive() costs > 2300 gas
// -> the transfer reverts, the user can never withdraw.
3

How to fix it

the pattern that is safe
(bool ok, ) = payable(to).call{value: amount}("");
require(ok, "transfer failed");   // forwards all remaining gas + reentrancy guard
Prefer call{value:...} with a reentrancy guard over transfer/send.
Check your own contract for this

The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0143 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.

Run the scanner See how it is attacked Read the docs