stake.link

Summary

Return value for transferAndCall not checked, if transactions failed the rewards token still transfer and can’t be distribute because trapped

Vulnerability Details

SDLPoolCCIPControllerPrimary::distributeRewards serves to claim and distribute rewards between secondary chains. The main problem is that the return value of the transferAndCall function is not checked whether it was successful or not. The code is below :

Here is the scenario :

1. The transferAndCall function is called with the wrapped token address, the token balance, and an empty calldata.

2. If the recipient contract reverts the transaction, the transferAndCall function will return false.

3. However, the code does not check the return value of the transferAndCall function.

4. This means that even if the transaction is reverted, the tokens will still be transferred from the contract.

5. As a result, the rewards will not be distributed to the whitelisted chains.

Impact

The rewards token still transfer and can’t be distribute because trapped

Tools Used

Manual review

Recommended Mitigation

1. Check the return value of the transferAndCall function.

2. If the transferAndCall function reverts, do not distribute the rewards to the whitelisted chain.

3. You can also use a try-catch block to handle the revert.