Foundry DeFi Stablecoin CodeHawks Audit Contest
Cyfrin
DeFiFoundry
15,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Certain ERC20 tokens such as USDT are unusable with `DSCEngine`

madalad

Summary

Some tokens (like USDT) don't correctly implement the EIP20 standard and their transfer/transferFrom function return void instead of a successful boolean. Calling these functions with the correct EIP20 function signatures will always revert.

Vulnerability Details

The following functions will always revert when certain ERC20 tokens are used:

File: src\DSCEngine.sol
​
149: function depositCollateral(address tokenCollateralAddress, uint256 amountCollateral)
150: public
151: moreThanZero(amountCollateral)
152: isAllowedToken(tokenCollateralAddress)
153: nonReentrant
154: {
155: s_collateralDeposited[msg.sender][tokenCollateralAddress] += amountCollateral;
156: emit CollateralDeposited(msg.sender, tokenCollateralAddress, amountCollateral);
157: bool success = IERC20(tokenCollateralAddress).transferFrom(msg.sender, address(this), amountCollateral); // @audit here
158: if (!success) {
159: revert DSCEngine__TransferFailed();
160: }
161: }
File: src\DSCEngine.sol
​
272: function _burnDsc(uint256 amountDscToBurn, address onBehalfOf, address dscFrom) private {
273: s_DSCMinted[onBehalfOf] -= amountDscToBurn;
274: bool success = i_dsc.transferFrom(dscFrom, address(this), amountDscToBurn); // @audit here
275: // This conditional is hypothtically unreachable
276: if (!success) {
277: revert DSCEngine__TransferFailed();
278: }
279: i_dsc.burn(amountDscToBurn);
280: }

Impact

Tokens that don't correctly implement the latest EIP20 spec, like USDT, will be unusable in the protocol as they revert the transaction because of the missing return value. Specifically, depositCollateral will be uncallable with those types of tokens, which is a disruption of core protocol functionality.

Tools Used

Manual review

Recommended Mitigation Steps

Use OpenZeppelin's SafeERC20 library for ERC20 transfers.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.