redeemToken sends tokens with safeTransferFrom

[code423n4]

Handle

pauliax

Vulnerability details

Impact

function redeemToken sends tokens to the msg.sender by using safeTransferFrom: _depositToken.safeTransferFrom(address(this), msg.sender, redeemableBalance); For safeTransferFrom to work it needs to have an enough approval. In this case, obviously this contract does not approve every msg.sender for redeemableBalance, so I expect this function to fail in practice. When the sender is address(this) it is best to use safeTransfer function: _depositToken.safeTransfer(msg.sender, redeemableBalance);

[PierrickGT]

Duplicate of https://github.com/code-423n4/2021-07-pooltogether-findings/issues/25

[0xean]

duplicate of #61