Summary

Some tokens like BNB do not return a bool on transfer(). This causes _redeemCollateral() to always revert with DSCEngine__TransferFailed.

Vulnerability Details

_redeemCollateral() has the following lines:

Since a token like BNB (which is supported by Chainlink BNB/USD price feed) does not return anything on calling transfer(), the value of success will always be false and hence this will revert.

Note that depositCollateral() or depositCollateralAndMintDsc() will still work for BNB as it returns true for a successful transferFrom(), thus allowing the users to deposit, but blocking them from redeeming it.

_redeemCollateral() is called by liquidate() too, hence breaking the functionality.

Impact

Liquidation of bad loans with BNB as collateral becomes impossible. Also, redeeming the collateral is blocked.

Tools Used

Manual review

Recommendations

• Use a list of whitelisted tokens.

• OR use low-level calls.