TSender

Cyfrin
DeFiFoundry
15,000 USDC
View results
Submission Details
Severity: high
Invalid

Incompatible token behavior in `Tsender.sol`

Summary

The TSender contract may encounter compatibility issues with tokens like USDT and WETH due to their deviation from the standard ERC20 behavior. The contract's reliance on the revert behavior for failed transfers may lead to misinterpretation of successful transfers as failures.

Vulnerability Details

The TSender contract checks for the success of the transferFrom and transfer calls by reverting the transaction if the calls return false. Among the given tokens (USDC, USDT, LINK, and WETH), USDT is known for not strictly adhering to the ERC20 standard and may exhibit this behavior. If USDT returns false on a successful transfer or transferFrom call, the TSender contract's current logic may not be compatible with USDT, and it could be vulnerable to misinterpreting successful transfers as failed transfers.
Also, when transferring ETH using WETH's transfer or transferFrom functions, WETH reverts on failure instead of returning false, which deviates from the standard ERC20 behavior.
Given this behavior, if the TSender contract expects a false return value to indicate a failed transfer and it interacts with WETH, successful transfers may be misinterpreted as failed transfers.

Impact

The potential impact includes loss of funds, incorrect token distribution, and unexpected behavior during token transfers. Compatibility issues with USDT and WETH may result in failed or misinterpreted transfers, leading to loss of funds or incorrect token distribution.

Tools Used

Manual code review and analysis

Recommendations

Update the contract's logic to handle tokens like USDT and WETH correctly, considering their unique behavior.

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Known issue

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.