Beedle - Oracle free perpetual lending

Summary

IERC20.transfer and IERC20.transferFrom functions is not compliant with USDT token

Vulnerability Details

IERC20.transfer and IERC20.transferFrom functions always return boolean value. In USDT contract transferFrom and transfer functions don't return any value.

Impact

When using any non-standard compliant token like USDT as a loanToken and collateralToken all functions using IERC20.transfer and IERC20.transferFrom functions will be reverted and users can't interact with core functions.

Tools Used

Manual

Recommendations

I recommend using OpenZeppelin’s SafeERC20 versions with the safeApprove function that handles the return value check as well as nonstandard-compliant tokens.