Description:
When a staker calls claimReward()
to withdraw their reward, it is sent to them with IERC20::transfer
function. However, the return value of an external transfer call in claimReward()
is not checked.
Impact:
Any transaction to msg.caller
that fails will fail silently, which could lead to a loss for the caller.
Tools Used:
Slither
Recommended Mitigation Steps:
Use SafeERC20
, or ensure that the transfer
return value is checked.
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.