Submission Details
Severity:
Some tokens have no return value on transferFrom
Summary
Some tokens, like USDT, do not return bool value on transferFrom(). So it will not be possible to deposit assets for some of them.
Vulnerability Details
Here is a function that is used for collateral deposit:
function depositCollateral(address tokenCollateralAddress, uint256 amountCollateral)
public
moreThanZero(amountCollateral)
isAllowedToken(tokenCollateralAddress)
nonReentrant
{
...
bool success = IERC20(tokenCollateralAddress).transferFrom(msg.sender, address(this), amountCollateral);
if (!success) {
revert DSCEngine__TransferFailed();
}
}
It requires a check that a call was successful and return a bool value. However not every token return it on a transfer\transferFrom call.
Impact
Users will not be able to make a deposit.
Tools Used
Manual review.
Recommendations
It's better to use a safeTransferFrom function or check the contract balance before and after the deposit.
Prize pool breakdown
Total prize
15,000 USDC
nSLOC
23664 USDC / LOC
14,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.