Beanstalk: The Finale
Beanstalk
DeFiHardhatFoundry
250,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Use safetransfer instead of transfer for ERC20 transfers.

erictee

Summary

Tokens not compliant with the ERC20 specification could return false from the transfer function call to indicate the transfer fails, while the calling contract would not notice the failure if the return value is not checked.

Checking the return value is a requirement, as written in the EIP-20 specification:

Callers MUST handle false from returns (bool success). Callers MUST NOT assume that false is never returned!

Vulnerability Details

In LibPipelineConvert.sol#L53:

IERC20(inputToken).transfer(C.PIPELINE, fromAmount);

.transfer function is used instead of .safetransfer function.

Impact

Returned value from transfer function is ignored.

Tools Used

Manual Analysis

Recommendations

It is recommended to use OpenZeppelin’s SafeERC20 wrapper with the IERC20
interface to make the contracts compatible with currencies that return
no value.

Updates

Lead Judging Commences

inallhonesty Lead Judge 12 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational/Gas

Invalid as per docs https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.