Dria
Swan
NFTHardhat
21,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Missing `safeTransfer` library can lead to bricked sales

carrotsmuggler

Summary

Tokens such as USDT do not return a bool on transfer. The ERC20 contract used in the projects expect a bool return on transfer calls. Contract can break due to this interface mismatch.

Vulnerability Details

Contracts of tokens like USDT do not return a bool on transfer function calls.

Code from mainnet:

function transfer(address _to, uint _value) public onlyPayloadSize(2 * 32) {
\\...
}

However, the project here uses ERC20 contract from openzeppelin which does expect a return value.

function transfer(address to, uint256 value) public virtual returns (bool) {
//...
}

Due to this mismatch, if the project decides to support USDT for purchases, the contracts will break. Because the ERC20 interface used in the contract will expect a return value but the mainnet contract wont return anything, resulting in a revert.

Impact

USDT on mainnet wont be supported by the protocol.

Tools Used

Manual Review

Recommendations

Consider using the safetransferLib. This can ignore missing return values for transfers.

Updates

Lead Judging Commences

inallhonesty Lead Judge 12 months ago
Submission Judgement Published
Invalidated
Reason: Known issue
Assigned finding tags:

[KNOWN] - Low-35 Unsafe use of transfer()/transferFrom() with IERC20

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.