Summary

The TokenDivider contract does not safely handle ERC20 token transfers in multiple functions. The code assumes that token transfers will always succeed without considering potential failures due to non-standard ERC20 implementations or other issues.

Vulnerability Details

Several instances in the contract fail to properly handle the return value of the transfer and transferFrom functions of ERC20 tokens. This could lead to situations where token transfers fail silently without reverting, resulting in inconsistencies in balances and potentially lost funds.

Affected Functions:

1. transferErcTokens

   • The IERC20(tokenInfo.erc20Address).transferFrom(msg.sender, to, amount) call does not check the success of the token transfer.

   https://github.com/Cyfrin/2025-01-pieces-protocol/blob/4ef5e96fced27334f2a62e388a8a377f97a7f8cb/src/TokenDivider.sol#L207

   IERC20(tokenInfo.erc20Address).transferFrom(msg.sender,to, amount);

2. sellErc20

   • The IERC20(tokenInfo.erc20Address).transferFrom(msg.sender, address(this), amount) call does not check the success of the token transfer.

   https://github.com/Cyfrin/2025-01-pieces-protocol/blob/4ef5e96fced27334f2a62e388a8a377f97a7f8cb/src/TokenDivider.sol#L248

   IERC20(tokenInfo.erc20Address).transferFrom(msg.sender,address(this), amount);

3. buyOrder

   • The IERC20(order.erc20Address).transfer(msg.sender, order.amount) call does not validate the success of the token transfer.

   https://github.com/Cyfrin/2025-01-pieces-protocol/blob/4ef5e96fced27334f2a62e388a8a377f97a7f8cb/src/TokenDivider.sol#L305

   IERC20(order.erc20Address).transfer(msg.sender, order.amount);

Impact

Failure to handle the return value of transfer and transferFrom in non-standard ERC20 tokens can lead to:

1. Silent Failures: Transfers might fail without reverting, leaving the contract in an inconsistent state.

2. Lost Tokens: Users could lose funds or tokens due to unhandled transfer failures.

Tools Used

• Manual code review.

Recommendations

To mitigate this issue you can do two things:

1. Check Return Values: Always validate the return value of transfer and transferFrom calls to ensure token transfers are successful. For example:

1. Use OpenZeppelin's SafeERC20 Library: This library wraps ERC20 functions and automatically handles both return value checks and compatibility with non-standard ERC20 implementations.