Root + Impact

Description

transfer(...) and transferFrom(...) are called without checking return values. Some ERC20 implementations return false instead of reverting on failure.

Risk

Likelihood:

• Some ERC20 tokens do not revert on failure and instead return false. Ignoring the return value means the contract assumes success even when the transfer failed.

Impact:

• contest funding or reward payout may appear successful while no tokens actually move, causing inconsistent state and potential fund loss.

Proof of Concept

1. Deploy a malicious ERC20 token where transfer and transferFrom return false.

2. Create a contest via ContestManager.createContest(...).

3. Approve ContestManager for the contest token.

4. Call ContestManager.fundContest(0).

5. Observe that the call does not revert, but the Pot contract does not receive the tokens.

Recommended Mitigation

• Use OpenZeppelin SafeERC20 and call safeTransfer / safeTransferFrom.

• Or add explicit checks such as require(token.transfer(...), "Transfer failed").