Beedle - Oracle free perpetual lending

Summary

Open Zeppelin's SafeERC20 library should be used to handle ERC20 transfers

Vulnerability Details

Not all ERC20 tokens are the same. Some return true on transfer others return false for example.The return values of the token transfers are not checked in this protocol.There are tokens that return false instead of reverting which will silently fail the transfer.Instead of adding a requirement to all transfers which checks the return value using safeTransfer/safeTransferFrom is the better option.These functions check the return data from the transfers and also handle non-standart-compliant tokens.The links provided are all places in the code where token transfers occur.

Impact

Tokens that return false on transfer are still counted as a correct transfer and tokens like (USDT) can't be used in the protocol as they revert the transaction because of the missing return value.

Tools Used

Manual Review

Recommendations

Use OpenZeppelin's safeERC20 library for transfers