First Flight #16: Mafia Takedown

Summary

The return value of an external transfer/transferFrom call is not checked

Vulnerability Details

Several tokens do not revert in case of failure and return false. If the transfer fails, an attacker can call deposit for free or users can lose their tokens if transfer fails in withdraw.

Impact

While the token used (USDC) reverts on transfer failed, it is behind a proxy so in the future it can be upgraded to not revert on transfer.

it is aslo a good practice to check the return value of an external transfer/transferFrom call.

• Found in src/modules/MoneyShelf.sol Line: 27

  usdc.transferFrom(account, address(this), amount);

• Found in src/modules/MoneyShelf.sol Line: 34

  usdc.transfer(to, amount);

• Found in src/modules/MoneyVault.sol Line: 34

  usdc.transfer(to, amount);

Tools Used

Static Analysis (slither)

Recommendations

It is recommended to use OpenZeppelin's SafeERC20 library.