Snowman Merkle Airdrop
AI First Flight #10
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: low
Invalid

Unchecked Return Value on i_weth.transfer() in collectFee()

rivera

Description

collectFee() calls i_weth.transfer() without checking its return value:

function collectFee() external onlyCollector {
uint256 collection = i_weth.balanceOf(address(this));
i_weth.transfer(s_collector, collection); // return value not checked
(bool collected,) = payable(s_collector).call{value: address(this).balance}("");
require(collected, "Fee collection failed!!!");
}

The ETH transfer right below it correctly checks its result; the WETH transfer does not.

Risk

Likelihood: Low. Requires a non-standard ERC20 that returns false on failure instead of reverting — standard WETH and this repo's MockWETH both revert on failure, so this doesn't manifest with the tokens actually in scope.

Impact: Low. If it did trigger, the collector would believe fees were swept when they weren't, silently losing WETH accounting — no direct fund theft, just incorrect state.

Recommended Mitigation

i_weth.safeTransfer(s_collector, collection); // SafeERC20 already imported elsewhere in the codebase
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 3 hours ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!