Submission Details
Severity:
USDC `transferFrom` return value is ignored in `MoneyShelf::depositUSDC`, causing transfer status is unchecked
Description
The function MoneyShelf::depositUSDC ignores return value of usdc.transferFrom, so even if the transfer fails sliently (as long as it doesnt revert), it will still mint crimeMoney to caller.
Impact
bank[to] might be changed, and crimeMoney might be minted to, even if no USDC is transferred to MoneyShelf. That could cause failure when later USDC is withdrawn, because there isnt enough USDC in this contract.
Recommendations
check the return value of usdc.transferFrom, if transfer fails, revert the tx
require(usdc.transferFrom(account, address(this), amount), "Token transfer failed");
Rewards breakdown
nSLOC
205This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.