Not calling approve(0) before setting a new approval causes the call to revert when used with Tether (USDT)

Lines of code Vulnerability details Some tokens do not implement the ERC20 standard properly but are still accepted by most code that accepts ERC20 tokens. For example Tether USDT's approve function will revert if the current approval is not zero, to protect against front-running changes of...

approve and safeApprove Should Approve the Zero Amount First

Lines of code Vulnerability details Impact The PooledCreditLine.sol and LenderPool.sol contracts approve the strategy contract on the collateral or borrow assets before depositing funds. This allows the strategy contracts to transfer on behalf of these contracts, pulling assets out from the pool...

Pool Credit Line May Not Able to Start When _borrowAsset is Non ERC20 Compliant Tokens

Lines of code Vulnerability details Impact IERC20borrowAsset.transferto, fee; If the USDT token is supported as borrowAsset, the unsafe version of .transferto, fee may revert as there is no return value in the USDT token contract’s transfer implementation but the IERC20 interface expects a return...

Calling approve() without first calling approve(0) causes problems with non-standard tokens (e.g. USDT)

Lines of code Vulnerability details This is another instance of the same issue that was found in the last sublime contest. In that issue the judge upgraded the finding to a risk of Medium. Impact Calling approve without first calling approve0 will revert with some tokens, such as Tether USDT. Thi...

Multiple missing approve(spender, 0) before approve(spender, amount)

Lines of code Vulnerability details Impact There are a few instances of missing calls to the IERC20 interface's approve function. The allowance needs to be set to 0 by calling for a given address and spender IERC20address.approvespender, 0. Not only do tokens like USDT require the allowance to be...

Must approve 0 first

Lines of code Vulnerability details Impact Some tokens like USDT do not work when changing the allowance from an existing non-zero allowance value.They must first be approved by zero and then the actual allowance must be approved. Proof of Concept Tools Used None Recommended Mitigation Steps Use...

non erc20 token might revert when calling emergencyWithdrawERC20()

Lines of code Vulnerability details Impact when there is an emergency situation, the admin can call emergencyWithdrawERC20 to save the funds, however due to mismatch between non erc20 token like USDT and openzeppelin IERC20 where the open zeppelin IERC20 is expecting a return on the transfer...

Use of IERC20.transfer() instead of SafeERC20.safeTransfer()

Lines of code Vulnerability details Impact There are multiple external calls to IERC20.transfer that suppose to transfer out tokens from the system. However, there are tokens like USDT that don't return any return value in their implementation of the transfer function, so calling IERC20.transfer ...

Cvx3CrvOracle does not check that Chainlink data is fresh.

Handle TomFrenchBlockchain Vulnerability details Impact Usage of stale prices when querying chainlink oracles. Proof of Concept Cvx3CrvOracle queries chainlink oracles for the prices of DAI, USDC and USDT, however it doesn't require that the response is fresh by checking which round the answer wa...

transfer return value of a general ERC20 is ignored

Handle mics Vulnerability details Need to use safeTransfer instead of transfer. As there are popular tokens, such as USDT that transfer/trasnferFrom method doesn’t return anything. The transfer return value has to be checked as there are some other tokens that returns false instead revert, that...

transfer return value of a general ERC20 is ignored

Handle pants Vulnerability details Need to use safeTransfer instead of transfer. As there are popular tokens, such as USDT that transfer/trasnferFrom method doesn’t return anything. The transfer return value has to be checked as there are some other tokens that returns false instead revert, that...

[WP-M8] totalUnderlyingMinusSponsored() may revert on underflow and malfunction the contract

Handle WatchPug Vulnerability details function totalUnderlyingMinusSponsored public view returns uint256 // TODO no invested amount yet return totalUnderlying - totalSponsored; As a function that many other functions depended on, totalUnderlyingMinusSponsored can revert on underflow when...

_transferAndCheckUnderlying doesn't work with fee-on-transfer tokens

Handle harleythedog Vulnerability details Impact There are several ERC20 tokens that take a small fee on transfers/transferFroms known as "fee-on-transfer" tokens. Most notably, USDT is an ERC20 token that has togglable transfer fees, but for now the fee is set to 0 see the contract here: . In th...

ERC20 return values not checked (2)

Handle cmichel Vulnerability details The ERC20.transfer, ERC20.transferFrom, ERC20.approve functions return a boolean value indicating success. This parameter needs to be checked for success. Also, some tokens like USDT don't correctly implement the EIP20 standard and their transfer/transferFrom...

Missing SafeApprove(0)

Handle sirhashalot Vulnerability details There are instances where the SafeApprove function is called only once without setting the allowance to zero. Some tokens, like USDT, require first reducing the address' allowance to zero by calling approvespender, 0. Additionally, the comment before the...

approvalHandler.transferFrom(..) isn't safe

Handle pants Vulnerability details approvalHandler can be set by the admin to any ERC20 token. A popular possible token is USDT, for example, which the admin can use. Then ignoring transferFrom return value isn't safe - since USDT transferFrom doesn't revert on failure but returns false instead...

MochiTreasuryV0.withdrawalCRV use unsafe transfer of ERC20

Handle pants Vulnerability details MochiTreasuryV0.withdrawalCRV use crv.transfer. There are some ERC20 tokens, as USDT for example, that aren't safe to use as crv. Since USDT.transfer doesn't revert on fail, the transfer may fail and because the return value is ignored the function will not...

ERC20 return values not checked

Handle cmichel Vulnerability details The ERC20.transfer and ERC20.transferFrom functions return a boolean value indicating success. This parameter needs to be checked for success. Some tokens do not revert if the transfer failed but return false instead. This value is not checked throughout the...

fee-on-transfer underlying can cause problems

Handle 0xsanson Vulnerability details Impact The current implementation doesn't work with fee-on-transfer underlying tokens. Considering that Compound can have these kind of tokens ex. USDT can activate fees, this issue can affect the protocol. The problem arise when transferring tokens, basicall...

Erc20.transferFrom() doesn't work on non-standard compliant tokens like USDT

Handle pants Vulnerability details Non-standard compliant tokens like USDT don't return a return value on transferFrom. The function Erc20.transferFrom reverts if the token doesn't return a return value, as it is defined to always return a boolean. Impact When using any non-standard compliant tok...