Summary

Use safeTransfer() or safeTransferFrom() from OpenZeppelin SafeERC20.sol library instead of transfer() and transferFrom().

Vulnerability Details

transfer() and transferFrom() might return false instead of reverting (see here). In this case involved functions continue to run as if the transfer succeeded.

Impact

This could lead to unexpected behaviours and broken system invariants.

Tools Used

Manual review

Recommendations

Use safeTransfer() or safeTransferFrom() from OpenZeppelin SafeERC20.sol library.