Submission Details
Severity:
[L-3] Lack of return value check for the function transferAndCallFrom::ERC677Upgradeable in certain contracts in the protocol
Description/Impact:
function transferAndCallFrom(
address _sender,
address _to,
uint256 _value,
bytes memory _data
) internal returns (bool) {
_transfer(_sender, _to, _value);
if (isContract(_to)) {
contractFallback(_sender, _to, _value, _data);
}
return true;
}
The function transferAndCallFrom::ERC677Upgradeable returns a boolean value to indicate a successful transfer. Failing to check this return value could lead to situations where the transfer fails, but the function continues to execute as if it succeeded. This occurs in certain contracts such as contracts\core\StakingPool.sol, contracts\liquidSDIndex\LiquidSDIndexPool.soletc
Recommended Mitigation:
require(transferAndCallFrom(
address _sender,
address _to,
uint256 _value,
bytes memory _data
), "TransferAndCallFrom failed")
Prize pool breakdown
Total prize
50,000 USDC
nSLOC
2,53020 USDC / LOC
42,000 USDC
4,250 USDC
3,750 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.