Submission Details
Severity:
Unsafe use of `transfer()/transferFrom()` with `IERC20`
Summary
Some tokens do not implement the ERC20 standard properly but are still accepted by most code that accepts ERC20 tokens. For example, Tether (USDT)'s transfer() and transferFrom() functions on L1 do not return booleans as the specification requires, and instead have no return value.
File: contracts/mock/SwapRouterMock.sol
9: IERC20(params_.tokenIn).transferFrom(msg.sender, address(this), params_.amountIn);
10: IERC20(params_.tokenOut).transfer(params_.recipient, params_.amountIn);
File: contracts/mock/GatewayRouterMock.sol
15: IERC20(_token).transferFrom(msg.sender, _to, _amount);
File: contracts/mock/tokens/WStETHMock.sol
25: stETH.transferFrom(msg.sender, address(this), stETHAmount_);
Recommendations
Consider using OpenZeppelin’s SafeERC20's safeTransfer()/safeTransferFrom() instead.
Updates
Prize pool breakdown
Total prize
22,500 USDC
nSLOC
1,05421 USDC / LOC
20,000 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.