Liquidity Management
Gamma
DeFiFoundry
50,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Use `transfer` instead `safeTransfer`

kevinkkien

Summary

In the _transferToken function, safeTransfer is used to transfer the fee to the treasury. However, when transferring the amount to the recipient, transfer is used instead. This can cause issues because some tokens do not return a boolean value when calling transfer, leading to errors if the contract does not handle this case properly.

Vulnerability Details

In the _transferToken function, safeTransfer is used to transfer the fee to the treasury

if (fee > 0) {
@> collateralToken.safeTransfer(treasury, fee);
}

when transferring the amount to the recipient, transfer is used instead.

@> try collateralToken.transfer(depositInfo[depositId].recipient, amount - fee) {}
catch {
@> collateralToken.transfer(treasury, amount - fee);
emit TokenTranferFailed(depositInfo[depositId].recipient, amount - fee);
}

If the token used is not ERC-20 compliant, calling collateralToken.transfer may fail.

Impact

Funds may fail to transfer to the intended recipient, leading to loss of trust and user funds.

Tools Used

manual

Recommendations

Leverage OpenZeppelin SafeERC20 library, which provides wrapper functions (safeTransfer, safeTransferFrom) to handle non-compliant tokens gracefully.

collateralToken.safeTransfer(depositInfo[depositId].recipient, amount - fee);
Updates

Lead Judging Commences

n0kto Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Out of scope
Assigned finding tags:

Informational or Gas

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelihood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

Suppositions

There is no real proof, concrete root cause, specific impact, or enough details in those submissions. Examples include: "It could happen" without specifying when, "If this impossible case happens," "Unexpected behavior," etc. Make a Proof of Concept (PoC) using external functions and realistic parameters. Do not test only the internal function where you think you found something.

n0kto Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Out of scope
Assigned finding tags:

Informational or Gas

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelihood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

Suppositions

There is no real proof, concrete root cause, specific impact, or enough details in those submissions. Examples include: "It could happen" without specifying when, "If this impossible case happens," "Unexpected behavior," etc. Make a Proof of Concept (PoC) using external functions and realistic parameters. Do not test only the internal function where you think you found something.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.