Beedle - Oracle free perpetual lending

Summary

The ERC20.transfer() method will return a boolean which results in a success or failure of the transaction. The returning value will need to be validated as there are some tokens which do not revert on failure.

It is good to add a require() statement that checks the return value of token transfers or to use something like OpenZeppelin’s safeTransferFrom unless one is sure the given token reverts in case of a failure. Failure to do so will cause silent failures of transfers and affect token accounting in contract.

Vulnerability Details

There are multiple instances of using transfer or transferFrom such as:

TKN.transfer(msg.sender, _amount);

https://github.com/Cyfrin/2023-07-beedle/blob/658e046bda8b010a5b82d2d85e824f3823602d27/src/Staking.sol#L49

Impact

Contracts risks silent failure on transfers.

Tools Used

Manual

Recommendations

Consider using OZ's safeTransfer()/safeTransferFrom() instead of transfer()/transferFrom().