Stratax Contracts
First Flight #57
Beginner FriendlyDeFi
100 EXP
View results
Previous Next
Submission Details
Impact: medium
Likelihood: medium
Invalid

ERC20 `transfer` Return Value Is Not Checked in `Stratax::recoverTokens`

sbb

ERC20 transfer Return Value Is Not Checked in Stratax::recoverTokens

Description:
The function calls IERC20(_token).transfer(...) without verifying whether the token transfer succeeded:

function recoverTokens(address _token, uint256 _amount) external onlyOwner {
@> IERC20(_token).transfer(owner, _amount);
}
​

Some ERC20 tokens return false on failure rather than reverting. Ignoring the return value can make the call appear successful while no tokens are actually transferred.

Impact:
Medium. In emergency recovery flows, a silent failure can cause tokens to remain stuck and complicate incident response and operations.

Recommended Mitigation:
At minimum, check the boolean return value (note: this still won’t handle tokens that don’t return a bool):

function recoverTokens(address _token, uint256 _amount) external onlyOwner {
- IERC20(_token).transfer(owner, _amount);
+ bool ok = IERC20(_token).transfer(owner, _amount);
+ require(ok, "Transfer failed");
}
​
Updates

Lead Judging Commences

izuman Lead Judge 16 days ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

WEIRD ERC20 Tokens

Currently there is no support for weird ERC20 tokens i.e. FOT tokens, missing return values, reentrancy etc.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!