Core Contracts

Finding description and impact

The contract assumes all tokens strictly adhere to the ERC20 standard, which is not always the case. Some tokens may have non-standard transfer or transferFrom implementations (USDT), causing transaction failures and rendering certain tokens unusable within the contract.

Proof of Concept

• Some tokens return false instead of reverting on failure.

• Example:

  function withdraw(

  address token,

  uint256 amount,

  address recipient

  ) external override nonReentrant onlyRole(MANAGER_ROLE) {

  if (token == address(0)) revert InvalidAddress();

  if (recipient == address(0)) revert InvalidRecipient();

  if (_balances[token] < amount) revert InsufficientBalance();

  _balances[token] -= amount;

  _totalValue -= amount;

  IERC20(token).transfer(recipient, amount); // May fail silently

  emit Withdrawn(token, amount, recipient);

  }

Recommended mitigation steps

Use OpenZeppelin’s SafeERC20 library to handle token transfers safely: