RebateFi Hook

Description:
withdrawTokens calls IERC20(token).transfer(to, amount) and ignores the boolean return value.

For standard OpenZeppelin-style ERC-20 tokens this is usually safe, but:

• Some tokens return false on failure instead of reverting.

• In that case, the contract:

  • will emit TokensWithdrawn, suggesting success,

  • but the token transfer will not actually happen.

Additionally, there is no guard against to == address(0), so the owner can accidentally burn protocol-owned tokens.

Impact:

• For non-standard tokens:

  • Potential silent failure of withdraws, leading to discrepancies between logs and real balances.

• For all tokens:

  • Owner can accidentally burn hook-held tokens by sending them to the zero address.

Proof of Concept:

Conceptual PoC (no extra mock required):

1. Deploy a non-standard ERC-20 that:

   • returns false in transfer,

   • does not revert.

2. Transfer some of those tokens to the hook.

3. Call withdrawTokens(address(token), recipient, amount):

   • Transaction succeeds, TokensWithdrawn is emitted.

   • Token balance of recipient remains unchanged.

This demonstrates that ignoring the return value can mislead monitoring and the owner.

Mitigation:
Use OpenZeppelin's SafeERC20 library or explicitly check the return value.

Optionally, restrict token to a known set of allowed tokens to reduce the risk of interacting with misbehaving ERC-20s.