Submission Details
Impact:
Likelihood:
Unsafe ERC20 transfer usage may silently fail
Root + Impact
Description
The contracts use raw ERC20 transfer() and transferFrom() calls without checking return values.
Root Cause
Examples:
i_token.transfer(player, reward);
token.transferFrom(msg.sender, address(pot), totalRewards);
Some ERC20 tokens return false instead of reverting on failure.
Risk
Likelihood
Many non-standard ERC20 implementations exist.
Failed transfers may occur silently.
Impact
Reward transfers may fail without reverting transactions.
Incorrect accounting and stuck rewards may occur.
i_token.transfer(player, reward);
token.transferFrom(msg.sender, address(pot), totalRewards);
Proof of Concept
function testTransferFailure() public {
// Mock ERC20 returns false instead of reverting
// Protocol logic continues despite failed transfer
// Rewards become inconsistent
}
Recommended Mitigation
- token.transfer(...)
- token.transferFrom(...)
+ token.safeTransfer(...)
+ token.safeTransferFrom(...)
Use OpenZeppelin `SafeERC20` library for all ERC20 interactions.
Rewards breakdown
This contest has a flat reward structure with the following payouts:
Live
The contest is live. Earn rewards by submitting a finding.
Judging
Submissions are being reviewed by our AI judge. Results will be available in a few minutes.
View all submissionsRewards Distribution
The contest is complete and the rewards are being distributed.