Submission Details
Severity:
transfer ERC20 token may failed due to using transferFrom instead of safeTransferFrom
Summary
The whole project use transferFrom or transfer to send ERC20 token, but some ERC20 token will return false rather than revert when transfer failed.
Vulnerability Details
for example in function purchase, if token return false rather than revert when transfer failed, listing.sellerwill not receive listing,price
// transfer money
token.transferFrom(listing.buyer, address(this), listing.price);
token.transfer(listing.seller, listing.price);
Impact
may causing loss fund
Tools Used
mannul review
Recommendations
use safeTransferFrom
Updates
Lead Judging Commences
inallhonesty 12 months ago
Submission Judgement Published Reason: Known issue
Assigned finding tags:
[KNOWN] - Low-35 Unsafe use of transfer()/transferFrom() with IERC20
Prize pool breakdown
Total prize
21,000 USDC
nSLOC
1,03420 USDC / LOC
20,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.