Lines of code

Vulnerability details

Summary

In withdraw function of USDeSilo.sol there is one call calling ERC20 transfer function on USDe token. And it’s return value neither checked nor safeTransfer of SafeERC20 used . So whenever transfer fails then it will not revert. And result in wrong execution of withdraw function of USDeSilo.sol.

Vulnerability Details :

Since transfer is called upon USDe token which is made using openzeppelin’s ERC20 contract. So it will return true when transfer successful. It will not revert on failure.

contracts/USDeSilo.sol#L29

28:   function withdraw(address to, uint256 amount) external onlyStakingVault {
29:     USDE.transfer(to, amount);//@audit return value should be checked OR use safeTransfer
30:    }

Impact

Whenever transfer fails then it will not revert. And result in wrong execution of withdraw function of USDeSilo.sol.

Tools Used

Manual

Recommended Mitigation Steps :

Since it is USDe token which is made using openzeppelin ERC20 contract so for this return value should be checked because it will not revert on failure.

1. Check return value and revert if return value is not true.
2. Or use Openzeppelin Library SafeERC20’s safeTransfer function instaed of transfer function. Which will automatically revert on failure.

Assessed type

Token-Transfer

---

The text was updated successfully, but these errors were encountered:

All reactions