search

code-423n4 / 2021-09-defiprotocol-findings

1 stars 0 forks source link

Check the actual amounts transferred #206

Open code423n4 opened 2 years ago

code423n4 commented 2 years ago

Handle

pauliax

Vulnerability details

Impact

Consider checking the actual amount transferred, e.g. in function addBounty as otherwise, you may have trouble with non-standard tokens, e.g. deflationary with a fee on transfer. The actual amount transferred is balanceOf the token before and after.

Recommended Mitigation Steps

uint256 before = IERC20(token).balanceOf(address(this)); token.safeTransferFrom(msg.sender, address(this), amount); uint256 after = IERC20(token).balanceOf(address(this)); amount = after - before;

frank-beard commented 2 years ago

https://github.com/code-423n4/2021-09-defiprotocol-findings/issues/236

GalloDaSballo commented 2 years ago

This finding comments on the correctness of trusting input vs actually checking what the changed balance is. There is no clear "attack" nor way to brick or grief the protocol. Agree with finding and severity