Tadle

Summary

Contract like CapitalPool.sol, DeliveryPlace.sol, PreMarkets.sol, SystemConfig.sol, and TokenManager.sol inherits Rescuable.sol. While erc20 like a USDT not returning a boolean for transfer and transferFrom function, this will lead to DoS for various function like TokenManager::tillIn , TokenManager::withdraw, TokenManager::rescue, etc.

Vulnerability Details

Unlike standard ERC20 tokens, which return a boolean value upon executing transfer and transferFrom operations and revert the transaction in case of failure, USDT lacks this important feature.

USDT's transfer and transferFrom functions do not return a boolean value. Instead, they simply calculate the fee and update the main state for transferring tokens without providing any return value.

The problem is this will make the function revert because it creates bool success as returned value but nothing is returned because the USDT transfer mechanism.

Therefore the next check to ensure success return truthy value will not be used and useless in this case.

Impact

DoS for function which inherits Rescuable::_safe_transfer and Rescuable::_safe_transfer_from function.

Tools Used

Manual Review

Recommendations

Consider using safeTransfer and safeTransferFrom from SafeERC20 library by Openzeppelin to tackle this issue.