Unchecked Token Transfers

[codehawks-bot]

Unchecked Token Transfers

Severity

High Risk

Summary

Token transfers lack proper error handling, leaving the contract vulnerable to failed transfers and unexpected behavior. This could lead to loss of tokens and incorrect contract behavior.

Vulnerability Details

The contract does not include checks to handle potential failure scenarios during token transfers. This lack of error handling can lead to tokens being lost during transfers and contract state not being updated correctly.

// Vulnerable Code: Lack of Error Handling in Token Transfer
function distribute(address token, address[] memory winners, uint256[] memory percentages, bytes memory data) public {
    require(msg.sender == address(proxyFactory), "Distributor__OnlyFactoryAddressIsAllowed");
    require(winners.length == percentages.length, "Distributor__MismatchedArrays");

    // ...

    for (uint256 i = 0; i < winners.length; i++) {
        // Vulnerable Code: Unchecked Token Transfer
        MockERC20(token).transfer(winners[i], (MockERC20(token).balanceOf(address(this)) * percentages[i]) / 10000);
    }

    emit Distributed(token, winners, percentages, data);
}

Impact

The absence of error handling during token transfers exposes the contract to failed transfers, potentially leading to a loss of tokens without appropriate state updates. This can result in incorrect balances and unexpected contract behavior.

Tools Used

Manual

Recommendations

1. Implement error handling in token transfers by checking the return value of the transfer function and reverting the transaction if the transfer fails.

2. Use the OpenZeppelin SafeERC20 library to perform token transfers, which provides standardized error handling for token transfers.

By following these recommendations, you can ensure that token transfers are executed safely and that the contract handles potential errors appropriately, minimizing the risk of lost tokens and incorrect contract behavior.

[PatrickAlphaC]

test files out of scope