Core Contracts

Summary

The audit identified an issue related to the usage of the transfer and transferFrom functions in ERC20 token transactions. The implementation directly calls these functions, which may cause compatibility issues with tokens that do not adhere strictly to the ERC20 standard.

Vulnerability Details

Description:

The protocol aims to support all ERC20 tokens but directly uses the standard transfer and transferFrom functions. Some tokens, such as USDT, do not fully comply with the ERC20 standard and do not return a boolean success value. As a result, calling these functions expecting a return value can lead to transaction reverts.

Affected Code:

The following functions suffer from this issue:

• Treasury in deposit

• Treasury in withdraw

Impact

Tokens that do not strictly follow the ERC20 standard, such as USDT, may revert transactions when transfer or transferFrom is called expecting a return value. This could render these tokens unusable within the protocol.

Tools Used

• Manual code review

Recommendations

1. Use OpenZeppelin’s SafeERC20 Library

   • Replace direct calls to transfer and transferFrom with safeTransfer and safeTransferFrom from OpenZeppelin’s SafeERC20 library.

   using SafeERC20 for IERC20;

   ​

   IERC20(token).safeTransferFrom(msg.sender, address(this), amount);

   IERC20(token).safeTransfer(recipient, amount);

2. Ensure Compatibility with Non-Standard ERC20 Tokens

   • Implement handling for tokens that do not return a success boolean.

   • Consider using low-level calls (call) to interact with these tokens safely.

By implementing these mitigations, the protocol can support a wider range of ERC20 tokens, including those with non-standard implementations like USDT, ensuring better usability and security.