The Standard

Summary

Use safeTransfer instead of transfer

Vulnerability Details

Tokens not compliant with the ERC20 specification could return false from the transfer function call to indicate the transfer fails, while the calling contract would not notice the failure if the return value is not checked. Checking the return value is a requirement, as written in the EIP-20 specification:

Callers MUST handle false from returns (bool success). Callers MUST NOT assume that false is never returned!

Impact

Even if the call for transfer fails it would not revert and the protocol would assume that transfer was successful but actually it was not.

Tools Used

Manual Review

Recommendations

Use the SafeERC20 library implementation from OpenZeppelin and call safeTransfer or safeTransferFrom when transferring ERC20 tokens.