MyCut

Summary

In the ContestManager.sol and Pot.sol contracts, functions responsible for token transfers rely on the standard transfer and transferFrom methods.

Vulnerability Details

Not all IERC20 implementations revert when there is a failure in transfer/transferFrom. The function signature has a boolean return value and they indicate errors that way instead. By not checking the return value, operations that should have marked as failed, may potentially go through without actually making a payment.

Impact

These standard methods pose risks due to varying implementations across different ERC20 tokens.

Tools Used

Manual review

Recommendations

It is suggested to use a wrapper like OpenZeppelin's SafeERC20 library when dealing with ERC20 transfers.