Summary

The solidity/assembly code does not verify the return value of the ERC20 calls that may return false if the transaction is not successful

Vulnerability Details

The contract first makes a transferFrom call and only verifies for execution reverted but not returned false as specified in ERC20

then it makes a batch of transfer calls that are also not verified, there may be the assumption that if the first transferFrom worked these will as well

But if any transfer does not work for any reason and the returnvalue is false this amount of tokens is stuck in the smart contract

The reason for an transaction to not work includes but are not limited to:
-transient lock not unlocked
-blacklisted recipient

Impact

Incorrect execution
Value stuck in smart contract

Tools Used

Hardhat /foundry

Recommendations

To add this verification and be carefull for cases like USDT that doesn't return anything