MyCut
AI First Flight #8
Beginner FriendlyFoundry
EXP
View results
Previous Next
Submission Details
Impact: medium
Likelihood: high
Invalid

Unchecked return value of i_token.transfer() in _transferReward silently fails for non-standard ERC20s

goat

Root + Impact

Unchecked return value of i_token.transfer() in _transferReward silently fails for non-standard ERC20s

Description

  • _transferReward calls i_token.transfer() without checking its return value. Some ERC20 tokens (e.g. USDT) return false on failure instead of reverting. The contract updates internal state — zeroing playersToRewards and decrementing remainingRewards — before the transfer, so a silent failure leaves the player with no tokens and no ability to retry.

// Root cause in the codebase with @> marks to highlight the relevant section
function _transferReward(address player, uint256 reward) internal {
@> i_token.transfer(player, reward); // audit-medium we are not checking the transaction return false or true
}

Risk

Likelihood:

  • Occurs whenever a non-standard ERC20 token that returns false instead of reverting is used

  • The protocol accepts any IERC20 token, making this a realistic deployment scenario

Impact:

  • Players permanently lose their rewards with no recourse

  • Contract accounting becomes corrupted with no way to detect or recover

Proof of Concept

// Token returns false on transfer (non-reverting ERC20)
playersToRewards[player] = 0; // ← state updated
remainingRewards -= reward; // ← state updated
i_token.transfer(player, reward); // ← returns false, no revert
// player receives 0 tokens, reward is gone from accounting

Recommended Mitigation

- remove this code
+import {SafeERC20} from "lib/openzeppelin-contracts/contracts/token/ERC20/utils/SafeERC20.sol";
​
+using SafeERC20 for IERC20;
​
-i_token.transfer(player, reward);
+i_token.safeTransfer(player, reward);
+ add this code
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 2 hours ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!