The Standard

Summary

ERC20 transfer functions return a boolean value indicating success. This parameter needs to be checked for success. Some tokens do not revert if the transfer failed but return false instead.

Vulnerability Details

Some tokens (like USDT) don't correctly implement the EIP20 standard and their transfer/ transferFrom function return void instead of a success boolean. Calling these functions with the correct EIP20 function signatures will always revert.

Impact

If tokens that don't actually perform the transfer and return false are still counted as a correct transfer, the users will suffer a loss of rewards.

Tools Used

Manual review

Recommendations

Constant use of safeTransfer functions, so that failed transfers are catched and reverted.