search

code-423n4 / 2021-07-spartan-findings

0 stars 0 forks source link

Dao has unchecked transfers #196

Closed code423n4 closed 3 years ago

code423n4 commented 3 years ago

Handle

heiho1

Vulnerability details

Impact

Dao.moveBASEBalance(address) and Dao.handleTransferIn(address,uint256) do not check transfer return values on lines 220 and 266. If the token implementation returns false and does not revert, then potentially the user can deposit for free.

Proof of Concept

https://github.com/code-423n4/2021-07-spartan/blob/e2555aab44d9760fdd640df9095b7235b70f035e/contracts/Dao.sol#L220

https://github.com/code-423n4/2021-07-spartan/blob/e2555aab44d9760fdd640df9095b7235b70f035e/contracts/Dao.sol#L266

Tools Used

Slither

Recommended Mitigation Steps

The functions should require a successful transfer or revert the call explicitly on failure.

SamusElderg commented 3 years ago

Duplicate of #8

ghoul-sol commented 3 years ago

https://github.com/code-423n4/2021-07-spartan-findings/issues/8#issuecomment-894852860