MyCut

Summary

The standard transfer() method of ERC20.sol do not return a value indicating success or failure. This can lead to failed transfers being treated as successful.

Vulnerability Details

The transfer() method is used throughout Pot.sol. Specifically in Pot.sol::_transferReward as well as within Pot.sol::closePot(), Pot.sol::claimCut() and ContestManager.sol::fundContest.

Impact

A transfer can fail but be treated as successful by the protocol. Users and owner may permanently lose funds as a result.

Tools Used

Manual Review

Recommendations

Implement SafeERC20 Library from Open Zeppelin and use safeTransfer() instead.