Summary

safeTransfer is necessary for tokens that do not revert on failure instead return false

The ReadMe states not non standard ERC20 tokens are not allowed, however the standard doesnt enforce a revert on failure, it instead enforces a false return on failure meaning that tokens in this category are in scope

An example of such tokens is EURS

Vulnerability Details

The registry for example checks the users allowance but not the balance,meaning the sender might not have the tokens so the call will return false but it is not handled
in this case the sender would still have tokens added to their state and they can withdraw the tokens from other users

Impact

protocol will not receive tokens and tokens can be stolen

Tools Used

manuak analysis

Recommendations

use safeTranser lib