The Standard

Summary

Some contracts use the transfer function of ERC20 tokens without checking the return value, which can cause silent failures or reverts if the token does not follow the standard.

Vulnerability Details

The contracts LiquidationPool and LiquidationPoolManager use the transfer function of IERC20 tokens to send rewards or fees to other addresses. However, they do not use a require statement to check the return value of the transfer function, which should be a boolean indicating success or failure. This can cause problems if the token does not implement the ERC20 standard properly, such as Tether (USDT), which does not return anything from its transfer function. In that case, the transfer function will either fail silently or revert, depending on how the token is cast to IERC20. This can affect the token accounting and logic of the contracts.

https://github.com/Cyfrin/2023-12-the-standard/blob/main/contracts/LiquidationPool.sol#L175

https://github.com/Cyfrin/2023-12-the-standard/blob/main/contracts/LiquidationPoolManager.sol#L40

Impact

The impact of this vulnerability is medium, as it can cause unexpected behavior or errors when interacting with non-standard ERC20 tokens. It can also make the contracts incompatible with some tokens, limiting their usability and functionality.

Tools Used

Manule

Recommended Mitigation Steps

Consider using safeTransfer/safeTransferFrom or require() consistently.