Beedle - Oracle free perpetual lending
BeedleFi
DeFiFoundry
20,000 USDC
View results
Previous Next
Submission Details
Severity: medium

Return values of `transfer()`/`transferFrom()` not checked

SolSaver

Summary

Return values of transfer()/transferFrom() not checked

Vulnerability Details

Not all IERC20 implementations revert() when there's a failure in transfer()/transferFrom(). The function signature has a boolean return value and they indicate errors that way instead. By not checking the return value, operations that should have marked as failed, may potentially go through without actually making a payment.

File: src/Fees.sol
​
43: IERC20(WETH).transfer(staking, IERC20(WETH).balanceOf(address(this)));
​

Link to code - https://github.com/Cyfrin/2023-07-beedle/tree/main/src/Fees.sol

File: src/Lender.sol
​
152: IERC20(p.loanToken).transferFrom(
​
159: IERC20(p.loanToken).transfer(
​
187: IERC20(pools[poolId].loanToken).transferFrom(
​
203: IERC20(pools[poolId].loanToken).transfer(msg.sender, amount);
​
267: IERC20(loan.loanToken).transfer(feeReceiver, fees);
​
269: IERC20(loan.loanToken).transfer(msg.sender, debt - fees);
​
271: IERC20(loan.collateralToken).transferFrom(
​
317: IERC20(loan.loanToken).transferFrom(
​
323: IERC20(loan.loanToken).transferFrom(
​
329: IERC20(loan.collateralToken).transfer(
​
403: IERC20(loan.loanToken).transfer(feeReceiver, protocolInterest);
​
505: IERC20(loan.loanToken).transfer(feeReceiver, protocolInterest);
​
563: IERC20(loan.collateralToken).transfer(feeReceiver, govFee);
​
565: IERC20(loan.collateralToken).transfer(
​
642: IERC20(loan.loanToken).transferFrom(
​
651: IERC20(loan.loanToken).transfer(feeReceiver, fee);
​
653: IERC20(loan.loanToken).transfer(msg.sender, debt - debtToPay - fee);
​
656: IERC20(loan.loanToken).transfer(feeReceiver, protocolInterest);
​
663: IERC20(loan.collateralToken).transferFrom(
​
670: IERC20(loan.collateralToken).transfer(
​

Link to code - https://github.com/Cyfrin/2023-07-beedle/tree/main/src/Lender.sol

File: src/Staking.sol
​
39: TKN.transferFrom(msg.sender, address(this), _amount);
​
49: TKN.transfer(msg.sender, _amount);
​
55: WETH.transfer(msg.sender, claimable[msg.sender]);
​

Link to code - https://github.com/Cyfrin/2023-07-beedle/tree/main/src/Staking.sol

Tools Used

Manual Code Review by SolSaver

Recommendations

Add a check to ensure that transfer()/transferFrom() return values are true

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!