The fundContest function in ContestManager and the _transferReward and closePot functions in Pot use standard IERC20.transfer and IERC20.transferFrom methods without verifying their boolean return values. Some ERC20 tokens do not revert on failure but instead return false, which would cause the contract to silently fail to transfer funds while still accounting for them. Other tokens do not return a boolean at all, which would cause the calls to revert. OpenZeppelin's SafeERC20 library should be used to handle these non-standard implementations safely.
The contest is live. Earn rewards by submitting a finding.
Submissions are being reviewed by our AI judge. Results will be available in a few minutes.
View all submissionsThe contest is complete and the rewards are being distributed.