Summary

In multiple functions, the return value of ERC20 transfers isn't checked, which could lead to malfunction of the TokenDivider contract.

Vulnerability Details

The functions TokenDivider::transferErcTokens, sellErc, buyOrder

don't validate the return value of the call to IERC20::transferFrom , and also IERC20::transfer . If these calls fail, returning false, the balances map would still be updated, or the s_userToSellOrders, and a TokensTransfered event emitted.

Impact

A discrepancy between the ERC20 and its respective NFT will cause major disfunction of the contract. Users may not be able to claim an NFT, even if they have collected all the pegged ERC20 tokens.

Tools Used

slitherin

Recommendations

Use the SafeERC20 contract, or validate explicitly that the transfer and transferFrom functions return true, and revert otherwise.