instead of call() , transfer() is used to withdraw the ether

[code423n4]

Lines of code

https://github.com/code-423n4/2022-10-holograph/blob/main/contracts/HolographOperator.sol#L596

Vulnerability details

Impact

The usage of send or transfer limits the amount of gas send in the trans�action to 2300. This can be considered a safeguard to avoid reentrancy.
However, given the current protections of the contracts, it does seem
feasible to use call function without further risk. This implies that
the system expects to be used by some contracts that can execute more
complex code on the fallback function.

Proof of Concept

  function send(
    uint256 gasLimit,
    uint256 gasPrice,
    uint32 toChain,
    address msgSender,
    uint256 nonce,
    address holographableContract,
    bytes calldata bridgeOutPayload
  ) external payable {
    require(msg.sender == _bridge(), "HOLOGRAPH: bridge only call");
    CrossChainMessageInterface messagingModule = _messagingModule();
    uint256 hlgFee = messagingModule.getHlgFee(toChain, gasLimit, gasPrice);
    address hToken = _registry().getHToken(_holograph().getHolographChainId());
    require(hlgFee < msg.value, "HOLOGRAPH: not enough value");
    payable(hToken).transfer(hlgFee);

Tools Used

vscode

Recommended Mitigation Steps

use call()

[gzeoneth]

Duplicate of #33

[gzeoneth]

Consider with #62