Submission Details
Severity:
Use `safeTransfer` and `safeTransferFrom` for token transfers, else breaks integration with certain collateral
Summary
Some tokens don't revert on transfers, rather they return false. For these tokens, the logic for this protocol breaks.
Vulnerability Details
In the setPool function there is the following code for token transfers:
IERC20(p.loanToken).transferFrom(
p.lender,
address(this),
p.poolBalance - currentBalance
);
For tokens which return false on failed transfers, this logic will not work as intended.
Impact
The logic for this protocol will not work for tokens which return false on failed transfers.
Tools Used
Manual review
Recommendations
Replace all transfer and transferFrom calls with safeTransfer and safeTransferFrom.
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
70628 USDC / LOC
18,000 USDC
2,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.