Beedle - Oracle free perpetual lending
BeedleFi
DeFiFoundry
20,000 USDC
View results
Previous Next
Submission Details
Severity: medium

Lack of error handling

0xbugalba

Summary

EIP20 standard:
Returns a boolean value indicating whether the operation succeeded.
function transfer(address to, uint256 amount) external returns (bool);

Checking the return value is a requirement, as written in the EIP-20 specification:

  • "Callers MUST handle false from returns (bool success). Callers MUST NOT assume that false is never returned!"

function withdraw(uint _amount) external {
updateFor(msg.sender);
balances[msg.sender] -= _amount;
TKN.transfer(msg.sender, _amount);
}

Details

  • https://github.com/SunWeb3Sec/DeFiVulnLabs/blob/main/src/test/Returnvalue.sol

Vulnerability Details

Impact

  • This could lead to unexpected behaviour in case of failure.

Tools Used

manual review

Recommendations

  • Correctly implement the function to ensure that there are no problems.

function withdraw(uint _amount) external {
updateFor(msg.sender);
balances[msg.sender] -= _amount;
(bool succes) = TKN.transfer(msg.sender, _amount);
}

  • You can also use OpenZeppelin's SafeERC20 library implementation and call safeTransfer or safeTransferFrom when transferring ERC20 tokens.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.