Root + Impact

Description

• The deployment script uses `IERC20.transfer()` without checking the return value. Some ERC20 tokens (like USDT) return `false` on failure instead of reverting, which could cause the deployment to succeed even when the token transfer fails, leaving the contract deployed but unfunded.

  ### Root + Impact

  The deployment script calls `transfer()` but doesn't verify the return value, assuming the call will revert on failure.

  ```solidity

  // script/Deploy.s.sol:18

  IERC20(0x1d17CBcF0D6D143135aE902365D2E5e2A16538D4).transfer(address(airdrop), s_amountToAirdrop);

  ```

  While most modern ERC20 tokens revert on failure, some legacy tokens (notably USDT) return `false`. If the transfer fails (e.g., insufficient balance, token paused, etc.), the deployment continues and the contract is deployed without funds.

Risk

Likelihood:

• * Some ERC20 tokens return `false` instead of reverting on transfer failure

  * The deployment script doesn't check return values

  * Transfer could fail due to insufficient balance, paused token, or other conditions

  * This occurs during the deployment process

Impact:

• * Contract may be deployed without receiving the intended tokens

  * Airdrop becomes non-functional as there are no tokens to distribute

  * Deployment appears successful but contract is unusable

  * Requires redeployment and additional gas costs

Proof of Concept

Recommended Mitigation