Submission Details
Severity:
`deposit()` in Staking.sol does not check return value.
Summary
deposit() in Staking.sol does not check return value for transferFrom().
Vulnerability Details
transferFrom() can return false. The contract will proceed to update user's mapping without actually receiving funds.
Impact
User can drain the protocol of all WETH from claim().
Tools Used
Manual Review
Recommendations
Consider using SafeERC20 library from OZ. Or make sure returned value is true. If not, revert().
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
70628 USDC / LOC
18,000 USDC
2,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.