Dria

Summary

Some ERC20 tokens may not follow the entire ERC20 specification. For example, transfer() and transferFrom() are expected to return true and revert on any failure, but USDT doesn't return any value. OpenZeppelin SafeERC20 library handles these cases.

https://github.com/Cyfrin/2024-10-swan-dria/blob/c8686b199daadcef3161980022e12b66a5304f8e/contracts/llm/LLMOracleRegistry.sol#L106

https://github.com/Cyfrin/2024-10-swan-dria/blob/c8686b199daadcef3161980022e12b66a5304f8e/contracts/llm/LLMOracleCoordinator.sol#L171

Vulnerability Details

Tokens that don't perform the transfer and return false are still counted as a correct transfer, an attacker can use that to perform actions for free

Impact

it is possible to call some functions without paying any tokens

Tools Used

Manual

Recommendations

Consider using OpenZeppelin's SafeERC20's safeTransfer() and safeTransferFrom() functions instead of calling transfer() and transferFrom() on the token directly.