call() should be used instead of transfer() on an address payable

[code423n4]

Lines of code

https://github.com/code-423n4/2022-10-holograph/blob/main/contracts/HolographOperator.sol#L596
https://github.com/code-423n4/2022-10-holograph/blob/main/contracts/enforcer/PA1D.sol#L396

Vulnerability details

Impact

The use of the deprecated transfer() function for an address will inevitably make the transaction fail when the caller is a smart contract and:

1. Does not implement a payable function.
2. Implements a payable fallback which uses more than 2300 gas unit.
3. Implements a payable fallback function that needs less than 2300 gas units but is called through proxy, raising the call's gas usage above 2300.

Additionally, using higher than 2300 gas might be mandatory for some multisig wallets.

Proof of Concept

https://github.com/code-423n4/2022-10-holograph/blob/main/contracts/HolographOperator.sol#L596
https://github.com/code-423n4/2022-10-holograph/blob/main/contracts/enforcer/PA1D.sol#L396

Tools Used

Manual review

Recommended Mitigation Steps

using call() instead of transfer() is recommended as suggested in https://consensys.net/diligence/blog/2019/09/stop-using-soliditys-transfer-now/

[gzeoneth]

Duplicate of #33

[gzeoneth]

As QA report