RebateFi Hook
First Flight #53
Beginner FriendlyDeFi
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Use of IERC20.transfer without checking return value; consider SafeERC20

smartshielder

Root + Impact

Description

  • Normal behavior: ERC20 transfers should be made via SafeERC20 (or at minimum check the boolean return) to support tokens that return false instead of reverting.

Problem: withdrawTokens calls IERC20(token).transfer(to, amount) and ignores the return value; non-standard tokens can return false and cause silent failures.

// Root cause in the codebase with @> marks to highlight the relevant section
function withdrawTokens(address token, address to, uint256 amount) external onlyOwner {
@> IERC20(token).transfer(to, amount);
emit TokensWithdrawn(token, to, amount);
}
​

Risk

Likelihood:

  • Occurs when withdrawing tokens that are non-standard (historical examples include some stablecoins and older tokens).

Many integrations may interact with a wide range of ERC20s, including non-standard ones.

Impact:

  • Transfers may silently fail (return false) leaving tokens in contract while owner believes they were withdrawn.

Can cause lost time, mistaken accounting, or locked assets until remedied on-chain.

Proof of Concept

When withdrawTokens is called with BadTokenMock address, transfer returns false but execution continues.

contract BadTokenMock {
function transfer(address, uint256) external pure returns (bool) {
return false; // non-standard behavior: returns false instead of reverting on failure
}
}
​

Recommended Mitigation

Add OpenZeppelin SafeERC20 and use safeTransfer:

+ import "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";
+ using SafeERC20 for IERC20;
function withdrawTokens(address token, address to, uint256 amount) external onlyOwner {
- IERC20(token).transfer(to, amount);
- emit TokensWithdrawn(token, to, amount);
+ IERC20(token).safeTransfer(to, amount);
+ emit TokensWithdrawn(token, to, amount);
}
​
Updates

Lead Judging Commences

chaossr Lead Judge 12 days ago
Submission Judgement Published
Validated
Assigned finding tags:

Not using safe transfer for ERC20.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!