Protocol doesn't support tokens not compatible with ERC20 standard
Summary
If non-compliant ERC20 tokens are added to pools (like USDT), then protocol may not be able to handle the transfers.
Vulnerability Details
The protocol uses transfer() and transferFrom() to transfer tokens. However, there are popular tokens like USDT which doesn't return data on transfers. Other tokens may return false on failure.
Impact
Protocol will revert or do incorrect accounting for these tokens.
Tools Used
Manual
Recommendations
Use OpenZeppelin's SafeERC20 library to handle ERC20 transfer. It handles cases where a token may return false on failure or not return anything at all.
Add the following at the top of the contract:
Replace all instances of calling transfer and transferFrom on ERC20 token with safeTransfer and safeTransferFrom.
For example for
https://github.com/Cyfrin/2023-07-beedle/blob/658e046bda8b010a5b82d2d85e824f3823602d27/src/Lender.sol#L159
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.