Summary

Vulnerability Details

Not all IERC20 implementations revert() when there's a failure in transfer()/transferFrom().

Impact

Not all IERC20 implementations revert() when there's a failure in transfer()/transferFrom(). The function signature has a boolean return value and they indicate errors that way instead. By not checking the return value, operations that should have marked as failed, may potentially go through without actually making a payment.

Tools Used

Manual Review

Recommendations

The function should check the return value of the transferFrom function and revert the transaction with an appropriate error message if the transfer fails. I would suggest to use Open Zeppelins safeTransferFrom.