Stratax Contracts
First Flight #57
Beginner FriendlyDeFi
100 EXP
View results
Previous Next
Submission Details
Impact: medium
Likelihood: medium
Invalid

transferFrom Return Value Not Checked When Pulling Collateral

sbb

transferFrom Return Value Not Checked When Pulling Collateral

Description:
Stratax::createLeveragedPosition pulls user collateral using IERC20.transferFrom but does not verify the transfer succeeded:

function createLeveragedPosition(
address _flashLoanToken,
uint256 _flashLoanAmount,
uint256 _collateralAmount,
address _borrowToken,
uint256 _borrowAmount,
bytes calldata _oneInchSwapData,
uint256 _minReturnAmount
) public onlyOwner {
require(_collateralAmount > 0, "Collateral Cannot be Zero");
// Transfer the user's collateral to the contract
@> IERC20(_flashLoanToken).transferFrom(msg.sender, address(this), _collateralAmount);
​
FlashLoanParams memory params = FlashLoanParams({
...
}
​

Some ERC20 tokens return false on failure instead of reverting. Ignoring the return value can cause the function to continue execution even if the transfer failed (or appear to fail in non-standard ways), leading to unexpected behavior when later steps assume collateral was received.

Impact:
Medium. If collateral is not actually transferred in, subsequent protocol actions may revert later (harder to diagnose) or operate under invalid assumptions, breaking the open-position flow and potentially causing funds/operations to get stuck mid-transaction (depending on downstream calls).

Recommended Mitigation:
At minimum, check the returned boolean (note: this does not cover tokens that do not return a bool):

- IERC20(_flashLoanToken).transferFrom(msg.sender, address(this), _collateralAmount);
+ bool ok = IERC20(_flashLoanToken).transferFrom(msg.sender, address(this), _collateralAmount);
+ require(ok, "transferFrom failed");
​
Updates

Lead Judging Commences

izuman Lead Judge 16 days ago
Submission Judgement Published
Invalidated
Reason: Known issue
Assigned finding tags:

WEIRD ERC20 Tokens

Currently there is no support for weird ERC20 tokens i.e. FOT tokens, missing return values, reentrancy etc.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!