Liquid Staking
Stakelink
DeFiHardhatOracle
50,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

In OperatorVault::deposit(), the return value for transferAndCall() function is not being checked

ravikiranweb3

Summary

In the OperatorVault contract's deposit function, the logic sends the tokens to stakeController contract by calling IERC677::transferAndCall function which returns a boolean flag to indicate the success or failure of the transaction.

The return value should be checked to ensure that underlying transaction was successful.

Vulnerability Details

The return values of certain functions returns information about whether the underlying transaction was successful or failed. It is important for the caller contract to conclude the success or failure of the transaction. This is to ensure that contracts are performing correct accounting of funds based on the transactions.

The issue with the below code is that the return value is not being checked.

function deposit(uint256 _amount) external override onlyVaultController {
trackedTotalDeposits += SafeCast.toUint128(_amount);
token.safeTransferFrom(msg.sender, address(this), _amount);
IERC677(address(token)).transferAndCall(address(stakeController), _amount, "");
}

Impact

Incorrect accounting

Tools Used

Manual

Recommendations

If the flag being returned is not reliable due to different implementations of IERC677 contracts, then it is recommended to implement logic similar to safe transfer library from openzepplien.

Updates

Lead Judging Commences

inallhonesty Lead Judge 12 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.