Submission Details
Severity:
[L-3] Unsafe ERC20 Operations should not be used
Description & Impact ERC20 functions may not behave as expected, the return vaule is not checked which can cause problems. For example: return values are not always meaningful.
Recommended mitigation It is recommended to use OpenZeppelin's SafeERC20 library.
4 Found Instances
+import {SafeERC20} from "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";
contract TokenDivider is IERC721Receiver, Ownable {]
+ using SafeERC20 for IERC20;
function divideNft(address nftAddress, uint256 tokenId, uint256 amount)
external
onlyNftOwner(nftAddress, tokenId)
onlyNftOwner(nftAddress, tokenId)
{
balances[msg.sender][erc20] = amount;
nftToErc20Info[nftAddress] = ERC20Info({erc20Address: erc20, tokenId: tokenId});
erc20ToMintedAmount[erc20] = amount; // amount of erc20 minted for the nft
erc20ToNft[erc20] = nftAddress;
emit NftDivided(nftAddress, amount, erc20);
- bool transferSuccess = IERC20(erc20).transfer(msg.sender, amount);
- if (!transferSuccess) {
- revert TokenDivider__TransferFailed();
- }
+ IERC20(erc20).safeTransfer(msg.sender, amount);
}
function transferErcTokens(address nftAddress, address to, uint256 amount) external {
.
.
.
if (to == address(0)) {
revert TokenDivider__CantTransferToAddressZero();
}
if (balances[msg.sender][tokenInfo.erc20Address] < amount) {
revert TokenDivider__NotEnoughErc20Balance();
}
balances[msg.sender][tokenInfo.erc20Address] -= amount;
balances[to][tokenInfo.erc20Address] += amount;
emit TokensTransfered(amount, tokenInfo.erc20Address);
- IERC20(tokenInfo.erc20Address).transferFrom(msg.sender, to, amount);
+ IERC20(tokenInfo.erc20Address).safeTransferFrom(msg.sender, to, amount);
}
function sellErc20(address nftPegged, uint256 price, uint256 amount) external {
.
.
.
s_userToSellOrders[msg.sender].push(
SellOrder({seller: msg.sender, erc20Address: tokenInfo.erc20Address, price: price, amount: amount})
);
emit OrderPublished(amount, msg.sender, nftPegged);
- IERC20(tokenInfo.erc20Address).transferFrom(msg.sender, address(this), amount);
+ IERC20(tokenInfo.erc20Address).safeTransferFrom(msg.sender, address(this), amount);
}
function buyOrder(uint256 orderIndex, address seller) external payable {
.
.
.
if (!success) {
revert TokenDivider__TransferFailed();
}
(bool taxSuccess,) = payable(owner()).call{value: fee}("");
if (!taxSuccess) {
revert TokenDivider__TransferFailed();
}
- IERC20(order.erc20Address).transfer(msg.sender, order.amount);
+ IERC20(order.erc20Address).safeTransfer(msg.sender, order.amount);
}
Rewards breakdown
nSLOC
181This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.