Unsafe usage of ERC20 transfer and transferFrom
Summary
There are 3 instances of unsafe use of the ERC20 transfer function that could have dangerous consequences.
Vulnerability Details
At the lines of code indicated above, there are 3 instances where the IERC20 transfer function is used to transfer ERC20 tokens. This is dangerous as some tokens don't revert on an unsuccessful transfer and these instances don't even check if the transfer has a returned a true boolean indicating a successful transfer.
Impact
Incomplete transfers will affect the claimRewards function in the LiquidationPool.sol contract and the distributeFees and forwardRemainingRewards function in the LiquidationPoolManager.sol contract
Tools Used
Manual review.
Recommendations
Use OpenZeppelin's safeTransfer function instead as used throughout the SmartVaultV5.sol contract.
Lead Judging Commences
unchecked-transfer
informational/invalid
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.