DittoETH

Summary

Not all ERC20 implementations revert() when there’s a failure in transfer()/transferFrom().

Vulnerability Details

The function signature has a boolean return value and they indicate errors that way instead. By not checking the return value, operations that should have marked as failed, may potentially go through without actually making a payment .

Impact

It is good to add a require() statement that checks the return value of token transfers or to use something like OpenZeppelin’s safeTransfer/safeTransferFrom unless one is sure the given token reverts in case of a failure. Failure to do so will cause silent failures of transfers and affect token accounting in contract.

Tools Used

Manual analysis

Recommendations

Consider using safeTransfer/safeTransferFrom or require() consistently.