Submission Details
Severity:
Loss of funds because of unsafe transfer function
Summary
Loss of funds because of unsafe transfer function in some ERC20 tokens
Vulnerability Details
Some ERC20 tokens may not revert in case of failures but just return a error message.
Since this error is not being checked in the code, it might lead to loss of funds.
Example:
// transfer fees
IERC20(loan.loanToken).transfer(feeReceiver, fees);
This call may not revert and return a bool saying that operation failed.
Since this return value is not checked, it can cause the protocol to loose fees.
Similar things in other places as well where transfer function is used.
Impact
Loss of funds
Tools Used
Manual Review
Recommendations
Add a check to see if the transfer actually succeeded.
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
70628 USDC / LOC
18,000 USDC
2,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.