Root + Impact

Using transfer instead of safeTransfer for WETH in collectFee fails to check return values, potentially causing silent transfer failures where the collector believes fees were collected when they were not.

Description

The contract imports and uses SafeERC20 for safe token operations. The collectFee function should use safeTransfer to ensure the transfer succeeds and properly handles tokens that return false on failure instead of reverting.

The function uses the standard transfer method instead of safeTransfer, which does not check return values. Some ERC20 tokens return false on failure rather than reverting.

Risk

Likelihood:HIGH

• Reason 1 :Occurs when interacting with non-standard ERC20 tokens that return false instead of reverting

• Reason 2:WETH is standard, but contract upgrade or wrapper changes could introduce this issue

Impact:

• Impact 1:Collector believes fees were collected when they were not

• Impact 2: Potential loss of accumulated fees

Proof of Concept

This test demonstrates that if WETH or a replacement token returns false instead of reverting on transfer failure, the collectFee function would continue execution without error, leaving the collector unaware that funds were not actually transferred.

Recommended Mitigation

Replace transfer with safeTransfer which properly checks return values and reverts on failure. Since SafeERC20 is already imported and declared, simply change the function call to ensure all token transfers are properly validated.