Summary

use safeTransfer/safeTransferFrom instead of transfer/transferFrom as some tokens return false

Vulnerability Details

Some tokens are not EIP-20 compliant so they return false on failure. When return value is not handled, the calling contract is at the receiving end as it doesn't handle the failure.

exactInputSingle function uses both transfer and transferFrom without handlng the return value.

Impact

Contract would deem transfer and transferFrom as a success when it returns false.

Tools Used

Manual review

Recommendations

Use Openzeppelin's safeTransfer and safeTransferFrom.