Dria

Vulnerability Details

The protocol is using transfer / transferFrom instead of safeTransfer / safeTransferFrom for all ERC20 transfers. The return value of the transfer is not checked so it is possible that the transfer fails silently (returning false) and the rest of the function executes normally which would lead to loss of funds for the protocol and users when the system assumed the funds have been transferred but they have not.

• LLMOracleCoordinator.sol#L170-L171

• LLMOracleCoordinator.sol#L374-L377

• LLMOracleRegistry.sol#L106

• BuyerAgent.sol#L275-L276

• Swan.sol#L263-L271

• Swan.sol#L292-L299

[!NOTE]
No Revert on Failure tokens are compliant with the ERC20 standard and thus deemed in-scope for this audit. The EIP-20 only requires tokens to return a bool, not to revert on transfer failure: https://eips.ethereum.org/EIPS/eip-20#transfer

Impact

Loss of funds for the protocol and users.

Recommendations

Use SafeERC20 for all ERC20 transfers.