Submission Details
Severity:
Lender.sol doesn't check return value for transferFrom() and transfer()
Summary
Multiple functions in Lender.sol do not check return value for transferFrom() and transfer().
Vulnerability Details
Function calls do not revert when returned value is false yet updates internal accounting. User can call borrow() while having 0 collateralToken in their wallet. After borrower repays, collateralTokens is sent back.
Impact
Drain all collateral token from contract/Permanent loss of funds.
Tools Used
Foundry
Recommendations
Considered using SafeERC20 library from OpenZeppelin.
https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/token/ERC20/utils/SafeERC20.sol
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
70628 USDC / LOC
18,000 USDC
2,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.