Beedle - Oracle free perpetual lending
BeedleFi
DeFiFoundry
20,000 USDC
View results
Previous Next
Submission Details
Severity: low

Return values of `transfer()`/`transferFrom()` not checked

ch0bu

Summary

Not all IERC20 implementations revert() when there's a failure in transfer()/transferFrom()

Vulnerability Details

Not all IERC20 implementations revert() when there's a failure in transfer()/transferFrom(). The function returns a bool value that indicate errors. By not checking the return value, operations that should have failed, may potentially go through without actually making a payment

43 IERC20(WETH).transfer(staking, IERC20(WETH).balanceOf(address(this)));

https://github.com/Cyfrin/2023-07-beedle/blob/main/src/Fees.sol#

152 IERC20(p.loanToken).transferFrom(
159 IERC20(p.loanToken).transfer(
187 IERC20(pools[poolId].loanToken).transferFrom(
203 IERC20(pools[poolId].loanToken).transfer(msg.sender, amount);
267 IERC20(loan.loanToken).transfer(feeReceiver, fees);
269 IERC20(loan.loanToken).transfer(msg.sender, debt - fees);
271 IERC20(loan.collateralToken).transferFrom(
317 IERC20(loan.loanToken).transferFrom(
323 IERC20(loan.loanToken).transferFrom(
329 IERC20(loan.collateralToken).transfer(
403 IERC20(loan.loanToken).transfer(feeReceiver, protocolInterest);
505 IERC20(loan.loanToken).transfer(feeReceiver, protocolInterest);
563 IERC20(loan.collateralToken).transfer(feeReceiver, govFee);
565 IERC20(loan.collateralToken).transfer(
642 IERC20(loan.loanToken).transferFrom(
651 IERC20(loan.loanToken).transfer(feeReceiver, fee);
653 IERC20(loan.loanToken).transfer(msg.sender, debt - debtToPay - fee);
656 IERC20(loan.loanToken).transfer(feeReceiver, protocolInterest);
663 IERC20(loan.collateralToken).transferFrom(
670 IERC20(loan.collateralToken).transfer(

https://github.com/Cyfrin/2023-07-beedle/blob/main/src/Lender.sol

39 TKN.transferFrom(msg.sender, address(this), _amount);
49 TKN.transfer(msg.sender, _amount);
55 WETH.transfer(msg.sender, claimable[msg.sender]);

https://github.com/Cyfrin/2023-07-beedle/blob/main/src/Staking.sol

Impact

Low

Tools Used

Manual review

Recommendations

Check for bool return value

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!