SoyFinance / smart-contracts

11 stars 9 forks source link

Security report: Standard ERC20 issues prevention #1

Closed Dexaran closed 2 years ago

Dexaran commented 3 years ago

These contracts are generally fine. There is just one addition that I would recommend: standard "ERC20 rescue function".

It would be better to:

  1. Implement an interface contract iERC20rescueable and make every contract that is not supposed to have ERC20 tokens at its balance to be iERC20rescueable
  2. Implement a function that would allow the "owner" of an iERC20rescueable contract to extract any arbitrary number of ERC20 tokens from the contract balance.
function rescueERC20(address _token, uint256 _amount)
{
    require(msg.sender == owner);
    IERC20(_token).transfer(owner, _amount);
}

This function would be usable if some other ERC20 token developer will carelessly implement a ERC20 token and some user will accidentally deposit the token to one of our contracts. It will be our responsibility to extract the token from our own contract then.