Pieces Protocol

Summary

The transferFromcall was used in the sellErc20and transferErcTokensto transfer tokens without first prompting the sender to approve the transaction.

Vulnerability Details

The sellErc20 and transferErcTokens functions are expressly using the transferFromcall without requiring or prompting the sender to approve the contract to carry out the transaction on their behalf.

Impact

1. Bad actors and malicious users bearing tokens could return falsewithout reverting which can lead to unexpected behaviour.

2. Transactions will either fail if approvals are missing or a sender's funds could be stolen should bad actors capitalize on the absence of approval.

Tools Used

Manual Code Review and Analysis

Recommendations

Use and implement the SafeERC20 library from OpenZeppelin to:

1. ensure the safe and secure transfer of ERC-20 tokens, and

2. ensure that the senders approve the contract for token transfer before the sellErc20 and transferErcTokens functions invoke the transferFrom call