Stratax Contracts
First Flight #57
Beginner FriendlyDeFi
100 EXP
View all submissions
Previous Next
Submission Details
Impact: medium
Likelihood: medium

ERC20 `transfer` Return Value Is Not Checked in `Stratax::recoverTokens`

Author Revealed upon completion

ERC20 transfer Return Value Is Not Checked in Stratax::recoverTokens

Description:
The function calls IERC20(_token).transfer(...) without verifying whether the token transfer succeeded:

function recoverTokens(address _token, uint256 _amount) external onlyOwner {
@> IERC20(_token).transfer(owner, _amount);
}
​

Some ERC20 tokens return false on failure rather than reverting. Ignoring the return value can make the call appear successful while no tokens are actually transferred.

Impact:
Medium. In emergency recovery flows, a silent failure can cause tokens to remain stuck and complicate incident response and operations.

Recommended Mitigation:
At minimum, check the boolean return value (note: this still won’t handle tokens that don’t return a bool):

function recoverTokens(address _token, uint256 _amount) external onlyOwner {
- IERC20(_token).transfer(owner, _amount);
+ bool ok = IERC20(_token).transfer(owner, _amount);
+ require(ok, "Transfer failed");
}
​

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!