Moonwell

Summary

usdt transferfrom does not have any return values on main-net eth, its a void function

Vulnerability Details

if you are expecting a true or false from this line require(token.transferFrom(msg.sender, address(this), amount), "transfer in failed");
it will always revert and funds(usdt) will not get send.

Impact

function will revert if sending usdt , funds will be locked in contract ,loss of funds. can cause A denial of service

Tools Used

manual

Recommendations

using OpenZeppelin’s SafeERC20 versions with the safeTransfer and safeTransferFrom functions that handle the return value check as well as non-standard-compliant tokens.