Liquidity Management

Summary

The _transferToken() function in the PerpetualVault contract uses inconsistent token transfer safety patterns, using safeTransfer() for fee transfers but standard transfer() for user withdrawals. This can lead to issues when handling the specific token implementations of WETH, WBTC, LINK, and USDC.

Vulnerability Details

The current implementation looks like this:

The issue is that different ERC20 tokens behave differently on failure:

1. USDC and WBTC: These tokens typically revert on transfer failure

2. WETH: Returns false on failure without reverting

3. LINK: Behavior can depend on the implementation version

Using transfer() directly is problematic because:

1. For tokens that return false on failure (like WETH), the failure is silently ignored

2. Even in the catch block, another transfer() is used instead of safeTransfer()

Impact

The inconsistent pattern could result in:

1. Silent failures: With tokens like WETH that return false instead of reverting, a failed transfer might not trigger the catch block, resulting in lost tokens

2. Treasury transfer failures: If the fallback transfer to treasury also fails, there's no further handling

   Given the specific tokens used (WETH, WBTC, LINK, and USDC), this inconsistency creates unpredictable behavior depending on which token is being used as collateral.

Tools Used

Manual code review

Recommendations

The simplest and most reliable solution is to use safeTransfer() consistently throughout the function:

Using SafeERC20's safeTransfer() is particularly important for WETH, which doesn't revert on failure and would otherwise silently fail with the current implementation.