Submission Details
Severity:
Protocol will not work correctly with tokens that do not revert on failed `transfer`
Summary
Some tokens do not revert on failure in transfer but instead return false (example is ZRX). While such tokens are technically compliant with the standard it is a common issue to forget to check the return value of the transfer calls. With the current code, if such a call fails but does not revert it will result in inaccurate calculations or funds stuck in the protocol.
if (balance > 0) IERC20(_token.addr).transfer(protocol, balance);
eurosToken.transfer(protocol, eurosToken.balanceOf(address(this)));
IERC20(_token.addr).transfer(msg.sender, _rewardAmount);
Tools Used
manual analysis
Recommendations
Use OpenZeppelin's SafeERC20 library and its safe methods like safeTransfer() for ERC20 transfers.
Updates
Lead Judging Commences
hrishibhat over 1 year ago
Submission Judgement Published Reason: Known issue
Assigned finding tags:
unchecked-transfer
informational/invalid
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
60933 USDC / LOC
17,500 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.