Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Improper Use of `transferFrom` Instead of `safeTransferFrom`

0xdoko

Summary

The contracts veRAACToken.sol, RToken.sol, and DEToken.sol use transferFrom instead of safeTransferFrom for token transfers. This practice can lead to unexpected failures when interacting with ERC-721 and ERC-1155 tokens, or with ERC-20 tokens that do not strictly conform to the ERC-20 standard.

Vulnerability Details

The transferFrom function is used for token transfers in several places across different contracts:

  1. veRAACToken.sol

​
function transferFrom(address from, address to, uint256 amount) public virtual override(ERC20, IveRAACToken) returns (bool) {
return super.transferFrom(from, to, amount);
}
​
​

  • The function does not ensure token safety and may result in failures for non-standard ERC-20 tokens.

  1. RToken.sol

​
function transferFrom(address sender, address recipient, uint256 amount) public override(ERC20, IERC20) returns (bool) {
uint256 scaledAmount = amount.rayDiv(_liquidityIndex);
return super.transferFrom(sender, recipient, scaledAmount);
}
​
​

  • Uses transferFrom without verifying if the token follows the standard behavior.

  1. DEToken.sol

​
function transferFrom(address sender, address recipient, uint256 amount) public override(ERC20,IERC20) onlyStabilityPool returns (bool) {
return super.transferFrom(sender, recipient, amount);
}
​
​

  • Restricts transfers to a specific pool but still relies on transferFrom without safety checks.

The primary issue is that transferFrom does not handle cases where tokens may revert or return false. Some tokens do not return a boolean, causing calls to break unexpectedly.

Impact

  • Failure to detect failed transfers: Some ERC-20 tokens (e.g., USDT, BNB, OMG) do not return a boolean, which may cause silent failures or unintended behavior.

  • Potential loss of funds: If transferFrom fails and the failure is not properly handled, funds could be stuck or lost.

  • Compatibility issues: Certain non-standard tokens may revert, leading to disruptions in contract execution.

Tools Used

Manual Review

Recommendations

  • Replace transferFrom with safeTransferFrom from OpenZeppelin’s SafeERC20 library:

​
using SafeERC20 for IERC20;
​
token.safeTransferFrom(sender, recipient, amount);
​
​

  • Ensure that transfer failures are handled properly by checking return values or wrapping transfers in try/catch.

  • Test with various ERC-20 tokens, including non-compliant ones, to validate expected behavior.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Known issue
Assigned finding tags:

[INVALID] SafeERC20 not used

LightChaser Low-60

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!