Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Use safeTransfer/safeTransferFrom consistently instead of transfer/transferFrom

0xalex_eth

Summary

Context: Treasury.sol#L50, Treasury.sol#L75

The deposit and withdraw functions in the Treasury contract use IERC20(token).transferFrom and IERC20(token).transfer, respectively, for transferring ERC20 tokens. However, this approach does not handle the case where a non-standard ERC20 token does not return a boolean value, leading to potential transaction failures.

Vulnerability Details

The contract directly calls transfer and transferFrom when handling ERC20 tokens. Some tokens (e.g., USDT, BNB, OMG) do not return a boolean value, causing transactions to fail unexpectedly. Additionally, some tokens may return false instead of reverting on failure, which the contract does not check.

Relevant Code Snippet:

function deposit(
address token,
uint256 amount
) external override nonReentrant {
if (token == address(0)) revert InvalidAddress();
if (amount == 0) revert InvalidAmount();
IERC20(token).transferFrom(msg.sender, address(this), amount);
_balances[token] += amount;
_totalValue += amount;
​
emit Deposited(token, amount);
}
function withdraw(
address token,
uint256 amount,
address recipient
) external override nonReentrant onlyRole(MANAGER_ROLE) {
if (token == address(0)) revert InvalidAddress();
if (recipient == address(0)) revert InvalidRecipient();
if (_balances[token] < amount) revert InsufficientBalance();
​
_balances[token] -= amount;
_totalValue -= amount;
IERC20(token).transfer(recipient, amount);
​
emit Withdrawn(token, amount, recipient);
}

Impact

Users may lose funds due to silent transfer failures or failed transactions for certain tokens.

Tools Used

Manual review

Recommendations

Use OpenZeppelin’s SafeERC20 library to replace transfer with safeTransfer and transferFrom with safeTransferFrom. This ensures proper handling of token transfers and prevents unexpected failures.

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Known issue
Assigned finding tags:

[INVALID] SafeERC20 not used

LightChaser Low-60

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.