collectFee uses a bare transfer with discarded return, so a non-standard WETH can silently lock feesThe contract declares using SafeERC20 for IERC20 and uses safeTransferFrom in buySnow, but collectFee moves the WETH balance with a raw ERC20 transfer whose boolean return is ignored.
A token that returns false on failure instead of reverting (USDT-style) would let collectFee continue and report success while no WETH actually moved.
Likelihood:
Depends on the configured WETH-like token. Canonical WETH reverts, but any non-standard or fee-on-transfer token returning false on failure triggers the silent path; the SafeERC20 import shows the codebase already expects to guard against this class.
Impact:
Collected fees remain locked in the contract while the call reports success, so the collector believes funds were swept when they were not. Loss is bounded to accrued fees.
A mock WETH returning false on transfer makes collectFee succeed yet move nothing.
Use the already-imported safeTransfer.
The contest is live. Earn rewards by submitting a finding.
Submissions are being reviewed by our AI judge. Results will be available in a few minutes.
View all submissionsThe contest is complete and the rewards are being distributed.