Ignoring return values for transfer and tranferFrom breaks the accounting system of the protocol
Summary
Protocol accounting system is broken as transfer and transferFrom function's return values are not being checked.
Vulnerability Details
transfer and transferFrom returns a bool to the caller to indicate whether the transfer succeeded or failed.
As there is no revert, if the calling logic ignores the return value and continues to account such transfers,
the protocol will not have its accounting in synch and hence a broken accounting system.
Impact
Broken accounting system leading to insolvency for protocol as well for losing user funds.
Tools Used
Manual transfer
Recommendations
Check the return values of transfer and transferFrom and revert incase of failures.
It would be better to use safe transfer utility from Openzeppelin.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.