The Standard
The Standard
DeFiHardhat
20,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

LiquidationPool::claimRewards claiming ERC20 does not check for return value of transfer

ravikiranweb3

Summary

The return value for transfer is not checked. While it is understood that all transfers are not implemented correctly, the risk of not checking the return value brings vulnerability in terms of incorrect judging the transaction outcome.

Vulnerability Details

The below transfer call's return value is not checked.

} else {
IERC20(_token.addr).transfer(msg.sender, _rewardAmount);
}

Impact

it impacts the account in the system as failures of the transfer call are not accounted. The user reward could be potentially lost.
When claiming, the entry from the rewards collection is deleted and if transfer fails, the tracking for the user reward will be lost.

Tools Used

Manual review

Recommendations

Using safe transfer wrapper functions from Openzepplien.

Updates

Lead Judging Commences

hrishibhat Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Known issue
Assigned finding tags:

unchecked-transfer

informational/invalid

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.