Submitted by CertoraInc, also found by kenta and wuwe1
LiquidityFarming.sol#L140
LiquidityFarming.sol#L145
LiquidityFarming.sol#L187
Low level calls (call, delegate call and static call) return success if the called contract doesnt exist (not deployed or destructed).
This makes a user be able to send his funds to non-existing addresses.
LiquidityFarming
reclaimTokens - if the owner calls by accident with a non-existing address hell lose the funds.
_sendRewardsForNft - if the withdraw or extractRewards will be called with a to non-existing address, the funds will be lost. Thats because of the call to _sendRewardsForNft which contains a low level call to the to address.
sendFundsToUser - if an executor calls by accident with a non-existing address the funds will be lost.
transfer - if the transfer function will be called (by the LiquidityProvidors contract of course) with a non existing address as a receiver, the funds will be lost.
This can be seen here https://github.com/Uniswap/v3-core/blob/main/audits/tob/audit.pdf (report #9) and here https://docs.soliditylang.org/en/develop/control-structures.html#error-handling-assert-require-revert-and-exceptions
ankurdubey521 (Biconomy) confirmed and commented:
pauliax (judge) commented:
