Submission Details
Severity:
Not Checking if the receiver handles transferring of ERC20 tokens, transfer()
Summary
The Contract contains the famous ERC20 transfer() and transferFrom() , which risks the loss of funds of contract accounts that do not handle ERC20 tokens.
Vulnerability Details
Contracts that are not aware that they will receive ERC-20 tokens will result in a loss of those tokens sent. The transfer() and transferFrom() methods exists in src/TokenDivider.sol :
148 --> bool transferSuccess = IERC20(erc20).transfer(msg.sender, amount);
326 --> IERC20(order.erc20Address).transfer(msg.sender, order.amount);
Impact
The user will loose their tokens permanently and they will be lost for ever.
Tools Used
Manual inspection.
Recommended Mitigation
Use pull pattern instead of push, i.e. make the user withdraw his funds by himself.
Use a different EIP.
Rewards breakdown
nSLOC
181This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.