Submission Details
Severity:
Users may not be able to buy Zeno bonds due to mandatory bool returned by `transferFrom`
Summary
Auction::buy reverts if USDT or other tokens which do not return a bool on ERC20 methods is used.
Auction is blocked.
Vulnerability Details
Auction::buy uses transferFrom to transfer tokens from msg.sender to businessAddress.
According to contest's Scope -> Compatibilities other tokens than USDC can be used with Zeno:
USDC or other ERC20 usable in Zeno
Some tokens (eg. USDT) doesn't return a bool on transferFrom.
Due to require statement in buy, the transaction reverts for such tokens.
function buy(uint256 amount) external whenActive {
require(amount <= state.totalRemaining, "Not enough ZENO remaining");
uint256 price = getPrice();
uint256 cost = price * amount;
@> require(usdc.transferFrom(msg.sender, businessAddress, cost), "Transfer failed");//@audit will revert if USDT is used
...
}
Impact
Users may not be able to buy Zeno bonds.
Tools Used
Recommendations
Use SafeERC20 library.
Updates
Lead Judging Commences
inallhonesty 7 months ago
Submission Judgement Published Reason: Known issue
Assigned finding tags:
[INVALID] SafeERC20 not used
LightChaser Low-60
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420
USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.