Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

M-1 Use safeTransfer and safeTransferFrom instead of transfer and transferFrom

radcipher

Summary

The deposit and withdraw functions in the contract Treasury.sol use transferFrom and transfer from the IERC20 interface without checking their return values. This can lead to unexpected failures when handling non-compliant ERC-20 tokens, which either do not return a boolean value or return false instead of reverting on failure.

function deposit(address token, uint256 amount) external override nonReentrant {
if (token == address(0)) revert InvalidAddress();
if (amount == 0) revert InvalidAmount();
// @audit use safeTransferFrom instead
IERC20(token).transferFrom(msg.sender, address(this), amount);
_balances[token] += amount;
_totalValue += amount;
emit Deposited(token, amount);
}
function withdraw(
address token,
uint256 amount,
address recipient
) external override nonReentrant onlyRole(MANAGER_ROLE) {
if (token == address(0)) revert InvalidAddress();
if (recipient == address(0)) revert InvalidRecipient();
if (_balances[token] < amount) revert InsufficientBalance();
_balances[token] -= amount;
_totalValue -= amount;
// @audit use safeTransfer instead
IERC20(token).transfer(recipient, amount);
emit Withdrawn(token, amount, recipient);
}

Vulnerability Details

  • Usage of transfer and transferFrom without proper checks.

Impact

  • If a token fails to transfer but does not revert, the contract incorrectly assumes the transfer succeeded, leading to incorrect balance tracking and potential fund loss or mismanagement.

  • This could make the contract incompatible with major tokens, limiting usability

Tools Used

  • Manual Review

Recommendations

  • Use SafeTransferLib or SafeERC20 to ensure secure token transfers. Replace transfer with safeTransfer and transferFrom with safeTransferFrom when handling ERC-20 tokens to prevent failures caused by non-standard implementations.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Known issue
Assigned finding tags:

[INVALID] SafeERC20 not used

LightChaser Low-60

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!