Submission Details
Severity:
[L-2] Return values of `transfer()`/`transferFrom()` not checked
Summary
Not all IERC20 implementations revert() when there's a failure in transfer()/transferFrom(). The function signature has a boolean return value and they indicate errors that way instead. By not checking the return value, operations that should have marked as failed may potentially go through without actually making a payment
Vulnerability Details
Instances (5):
File: src/Lender.sol
323: IERC20(loan.loanToken).transferFrom(
329: IERC20(loan.collateralToken).transfer(
656: IERC20(loan.loanToken).transfer(feeReceiver, protocolInterest);
File: src/Staking.sol
39: TKN.transferFrom(msg.sender, address(this), _amount);
49: TKN.transfer(msg.sender, _amount);
Impact
Tools Used
Recommendations
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
70628
USDC / LOC
18,000 USDC
2,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.