Non standard token transfers will fail in the protocol

Lines of code Vulnerability details Impact In TokenTransferrer.sol the performERC20Transfer function handles the transfer of ERC20 tokens in the protocol. It uses the ERC20transferFromsignature constant inherited from TokenTransferrerConstants.sol. The problem is that tokens that don’t correctly...

ConvexMasterChef: safeRewardTransfer can cause loss of funds

Lines of code Vulnerability details Impact Same as code-423n4/2022-02-concur-findings244 All calculations are rounded down, since a lack of tokens in the contracts cannot be rounding errors' fault. So the function is redundant. On the other hand, if the contract is undersupplied with cvx tokens,...

Malicious ERC20 or ERC777 could be used as collateral

Lines of code Cally.solL296 Vulnerability details Impact A malicious ERC20 or ERC777 could be used as collateral and rug the exerciser on exercise through a malicious implementation of ERC20vault.token.safeTransfer. Proof of Concept Any ERC20/ERC777 token is accepted as there is no whitelist. Thi...

Options can be sold for tokens that have been destructed

Lines of code Vulnerability details Unlike OpenZeppelin's safeTransfer, solmate's version of the function does not check for contract existence before its low level calls are made. The foot-gun associated with this difference is that it's up to the caller to verify that the contract exists before...

Batch Transfer will likely fail on ERC777 transfers, either maliciously or accidentally

Lines of code Vulnerability details Impact If users attempt to bridge ERC777s from Cosmos to Ethereum, it is highly likely that the transfers will revert. The issue lies in the combination of using safeTransfer and the idea of batching. safeTransfer will revert for any failed transfer meaning tha...

In MerkleVesting.sol::withdraw check return value of ERC20 transfer or use safeTransfer of OZ

Lines of code Vulnerability details Impact MerkleVesting.solL173 tree.tokenBalance -= currentWithdrawal; IERC20tree.tokenAddress.transferdestination, currentWithdrawal; In case of failed transfer here it do not check return value of transfer. it updates the tree balance without transfering the...

Transfers Will Revert On Non-Standard ERC20 Token Contracts

Lines of code Vulnerability details Impact There are several contracts which do not utilise OpenZeppelin's SafeERC20 library when performing token transfers. The FactoryDAO suite of smart contracts intends to support transfers by all tokens, including non-standard tokens such as USDT which does n...

Reentrency in claimRewards in ConcurRewardPool

Judge @GalloDaSballo has assessed the 1st item in QA Report 163 as Medium risk. The relevant finding follows: … Reentrency in claimRewards in ConcurRewardPool The function claimRewards is open to reenterncy, if the safeTransfer function of a token calls the claimRewards again the tokens can be...

Transfer return value is ignored

Impact Some ERC20 tokens, such as USDT, don't revert when transfer/transferFrom fails. The transfer return value has to be checked as there are some other tokens that returns false instead revert. safeTransfer should be used instead of transfer Proof of Concept safeTransferFrom should be used...

Use safeTransfer instead of transferFrom

Lines of code Vulnerability details Impact In the following line, transferFrom is used. However, this function transfers funds from CoreCollection contract to msg.sender. That's why transfersafeTransfer must be used. Like the comment describes, if a royalty vault isn't set, tokens are kept within...

Use safeTransfer

Lines of code Vulnerability details Impact The return value of the transfer is not checked. You already imported SafeERC20 into this contract, so you can use it to resolve this issue. Proof of Concept Tools Used manual code review Recommended Mitigation Steps IERC20borrowAsset.safeTransferto, fee...

Forcing ERC20Upgradeable when calling transfer() reverts when used with some ERC20 tokens

Lines of code Vulnerability details Some tokens do not implement the ERC20 standard properly but are still accepted by most code that accepts ERC20 tokens. For example Tether USDT's transfer and transferFrom functions do not return booleans as the specification requires, and instead have no retur...

Using transfer instead of safeTransfer allows attacker to steal all staked tokens

Lines of code Vulnerability details Impact An attacker can drain all staked tickets. Proof of Concept In the withdrawDelegationToStake function the user can transfer from one of his delegations to the TWABDelegator contract and receive vault tokens he can then unstake to get his tickets back...

safeConcurTransfer can cause loss of funds

Lines of code Vulnerability details Impact All calculations are rounded down, since a lack of tokens in the contracts cannot be rounding errors' fault. So the function is redundant. On the other hand, if the contract is undersupplied with Concur tokens, this will cause depositors to be sent less...

Potential Re-entrancy Attack via ETH or ERC777 Token Transfer

Lines of code Vulnerability details Impact The CEI pattern is not being implemented properly in the claimRewards function of the ConcurRewardPool.sol. function claimRewardsaddress calldata tokens external override for uint256 i = 0; i tokens.length; i++ uint256 getting = rewardmsg.sendertokensi;...

flan can't be transferred unless the flan contract has flan balance greater than the amount we want to transfer

Handle CertoraInc Vulnerability details Flan.sol safeTransfer function The flan contract must have balance and must have more flan then we want to transfer in order to allow flan transfers. If it doesn't have any balance, the safeTransfer, which is the only way to transfer flan, will call transfe...

ERC20 transfer might fail

Handle hack3r-0m Vulnerability details while withdrawing incentives, the contract does not check if erc20 transfer was successful or not, if due to minor rounding error at 17th/18th decimal place, which is possible and the contract does not have enough token to make the transfer and hence false i...

transfer return value of a general ERC20 is ignored

Handle mics Vulnerability details Need to use safeTransfer instead of transfer. As there are popular tokens, such as USDT that transfer/trasnferFrom method doesn’t return anything. The transfer return value has to be checked as there are some other tokens that returns false instead revert, that...

Unchecked return value for token.transfer call

Handle WatchPug Vulnerability details It is usually good to add a require-statement that checks the return value or to use something like safeTransfer; unless one is sure the given token reverts in case of a failure. Instances include: token.transfermsg.sender, amount; token.transfermsg.sender,...

transferFrom return value unchecked

Handle hack3r-0m Vulnerability details createRJLaunchEvent is followed by initialization of launch event, the balance of launch event address is what is supplied by above mentioned safe transfer call According to EIP20, transferFrom returns boolean function transferFromaddress from, address to,...