Beedle - Oracle free perpetual lending
BeedleFi
DeFiFoundry
20,000 USDC
View results
Previous Next
Submission Details
Severity: high

Use safeTransfer/safeTransferFrom consistently instead of transfer/transferFrom

polaris_tow

Summary

Use safeTransfer/safeTransferFrom consistently instead of transfer/transferFrom

Vulnerability Details

Some tokens do not return a bool (e.g. USDT, BNB, OMG) on ERC20 methods.
https://github.com/d-xo/weird-erc20/#no-revert-on-failure
Tranfser/transferfrom is directly used to send tokens in many places in the contract and the return value is not checked.
If the token send fails, it will cause a lot of serious problems.Let's take an example within this contract. The lender can specify any ERC20 token, such as USDT. In the 'addToPool' function, they can increase the balance of the pool. However, even if the token transfer fails, the function will not revert. The 'addToPool' function will continue to execute successfully. The same issue exists in other functions like 'repay' and 'borrow'. This could lead to severe consequences."

function addToPool(bytes32 poolId, uint256 amount) external {
if (pools[poolId].lender != msg.sender) revert Unauthorized();
if (amount == 0) revert PoolConfig();
_updatePoolBalance(poolId, pools[poolId].poolBalance + amount);
// transfer the loan tokens from the lender to the contract
IERC20(pools[poolId].loanToken).transferFrom(
msg.sender,
address(this),
amount
);
}

Impact

If the token send fails, it will cause a lot of serious problems.

Tools Used

vscode

Recommendations

Consider using safeTransfer/safeTransferFrom consistently.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!