# GroupBuy does not check return value of call

GroupBuy ignores the boolean return of low-level ETH calls, so a reverting receiver's contribution is zeroed out while no ETH is sent, losing funds.

- Payout: Contest reward
- Severity: high
- Program: Tessera
- Credited: Lambda
- Disclosed: 2023-04-18
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-12-tessera-findings/issues/6
- Library page: https://bugbountylibrary.com/r/c4%3A2022-12-tessera%3AH-01
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:business-logic

**Target:** GroupBuy.sol ETH payout via low-level call
**Root cause:** Low-level `call{value:...}("")` return value is unchecked; state (balance/contribution) is cleared regardless of transfer success.
**Steps:**
1. Deploy a contract whose `receive()` reverts (e.g. AMM swap with high slippage or low liquidity).
2. Have it contribute to a GroupBuy pool.
3. Trigger refund/payout path at GroupBuy.sol L265 or L283.
4. `call` returns false but tx continues; `userContributions` deleted / balance set to 0 with no ETH received.
**How found:** Code review of the two `call` sites in GroupBuy.sol noticing the missing success check on ETH transfers.
**Exploitation:** Recipient contract with reverting receive() loses its contribution/refund because GroupBuy marks it settled without transferring ETH; funds remain stuck in contract.
**Insight:** In Solidity, low-level `call` never reverts on failure; audit every `call{value:}` for a checked return or `require(success)` — especially where state is zeroed after the transfer.