Submission Details
Severity:
`MoneyVault::withdrawUSDC` function has no check for the return value of the transfer function being used
Summary
function withdrawUSDC(address account, address to, uint256 amount) external {
require(to == kernel.executor(), "MoneyVault: only GodFather can receive USDC");
withdraw(account, amount);
crimeMoney.burn(account, amount);
-->> usdc.transfer(to, amount); //no check for return value
}
Impact
The user can call the withdrawUDSC infinite number of times and may cause harm to the protocol by using some exploits as the return value of the transfer function is not checked.
Tools Used
slither, aderyn , manual review
Recommendations
Add following lines in the code
function withdrawUSDC(address account, address to, uint256 amount) external {
require(to == kernel.executor(), "MoneyVault: only GodFather can receive USDC");
withdraw(account, amount);
crimeMoney.burn(account, amount);
+ require(usdc.transfer(to,amount) != false , "Transfer Failed");
_ usdc.transfer(to, amount);
}
Rewards breakdown
nSLOC
205This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.