Return values of transfer()/transferFrom() not checked

Vulnerability Details

Not all ERC20 implementations revert() when there's a failure in transfer() or transferFrom(). The function signature has a boolean return value and they indicate errors that way instead. By not checking the return value, operations that should have marked as failed, may potentially go through without actually transfer anything.

Lines of code

Total -> 10

76, 77, 155, 177, 199, 224, 153, 175, 197, 222

Impact

Not all ERC20 implementations revert() when there's a failure in transfer() or transferFrom(). The function signature has a boolean return value and they indicate errors that way instead. By not checking the return value, operations that should have marked as failed, may potentially go through without actually transfer anything.

Tools used

Manual review

Recommended Mitigation Steps

Check the return value of transfer()/transferFrom() functions.