Moonwell

Summary

revert on transfer

Vulnerability Details

ERC20 transfers can cause lock up

Impact

Some major tokens went live before ERC20 was finalised, resulting in a discrepancy whether the transfer functions a) should return a boolean or b) revert/fail on error. The current best practice is that they should revert, but return “true” on success. However, not every token claiming ERC20-compatibility is doing this — some only return true/false; some revert, but do not return anything on success. This is a well known issue, heavily discussed since mid-2018.This is only possible if the underlying ERC20 used is not reverting on failures, but return “false” instead.

Tools Used

manual , slither

Recommendations

Use something like OpenZeppelin’s SafeERC20
Set up an allow list for tokens, which are knowingly safe