MyCut

Description:

This part of code misses to verify the return value of the external transferFrom calls, this is risky because not all the token transferFrom functions revert on fail, some tokens return false if the transfer fails.

Impact:

If the ContestManager::fundContest function does not verify the return value of the transferFrom, the transfer may fail, and the owner will be unaware of this issue until an user try to claim a cut, only to discover that there no funds to claim.

Proof of Concept:

1. Owner calls ContestManager::fundContest to fund the contest.

2. For any reason transferFrom call fails and returns false because that particular token doesn't revert and owner is unaware about that.

3. User tries to claim a cut calling Pot::claimCut but it isn't possible because the token balance of Pot contract is zero.

Recommended Mitigation:

Use SafeERC20, or ensure that the transfer/transferFrom return value is checked.