Summary

Not all IERC20 implementations revert when there's a failure while transfering. The function signature has a boolean return value and they indicate errors that way instead. By not checking the return value, operations that should have marked as failed, may potentially go through without actually making a payment.

Vulnerability Details

see Summary

Impact

see Summary

Tools Used

Manual Review

Recommendations

check the returned value of the Transfer function