code-423n4 / 2021-06-tracer-findings

1 stars 0 forks source link

No check transferFrom() return value #115

Open code423n4 opened 3 years ago

code423n4 commented 3 years ago

Handle

s1m0

Vulnerability details

Impact

The smart contract doesn't check the return value of token.transfer() and token.transferFrom(), some erc20 token might not revert in case of error but return false. In the TracerPerpetualSwaps:deposit and Insurance:deposit this would allow a user to deposit for free. Other places: TracerPerpetualSwaps: withdraw TracerPerpetualSwaps:withdrawFees SafetyWithdraw:withdrawERC20Token Insurance:withdraw

Recommended Mitigation Steps

Wrap the call into a require() or use openzeppelin's SafeERC20 library.