addToPool balance check
Summary
The addToPool function does not check if the transferFrom has succeeded.
Vulnerability Details
Because the _updatePoolBalance(poolId, pools[poolId].poolBalance + amount); is run without checking if the transferFrom was a success. With the standard ERC20 tokens the transactions gets reverted when there was something wrong with the transferFrom (so the _updatePoolBalance gets rolled back to the previous state). But some ERC20 tokens return false instead of reverting.
Impact
We can add more tokens to our pool then we actually have with some ERC20 tokens.
Tools Used
vscode
Recommendations
Add a simple require check that the transferFrom is a success.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.