Beedle - Oracle free perpetual lending
BeedleFi
DeFiFoundry
20,000 USDC
View results
Previous Next
Submission Details
Severity: high

Put ERC20 operations in require() or Check their return values.

0xsandy

Summary

The return values of ERC20 operations like transfer and transferFrom functions is not checked.

Vulnerability Details

There two ERC20 operations i.e transfer and transferFrom which are heavily used in the contract and these functions return a bool as output to determine these functions succeeded or not. But these return values are not checked in the contract.

Impact

For the scenarios like funds not approved, malicious token and transfer failed which usually throw false as return value for these ERC20 operations but the return values is not checked causing serious mismanagement and loss of funds.

Tools Used

Manual Analysis

Recommendations

  1. Check the return values of these function and if they return false, revert the transaction with custom errors:

bool success = IERC20(pools[poolId].loanToken).transferFrom(msg.sender, address(this), amount);
if (!success) revert tranferFailed();

OR

  1. Put these operations in a require block like in an example given below:

require(IERC20(pools[poolId].loanToken).transfer(msg.sender, amount), "transfer failed");

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.