Consider checking the actual amount transferred, e.g. in function addBounty as otherwise, you may have trouble with non-standard tokens, e.g. deflationary with a fee on transfer. The actual amount transferred is balanceOf the token before and after.
Recommended Mitigation Steps
uint256 before = IERC20(token).balanceOf(address(this));
token.safeTransferFrom(msg.sender, address(this), amount);
uint256 after = IERC20(token).balanceOf(address(this));
amount = after - before;
This finding comments on the correctness of trusting input vs actually checking what the changed balance is.
There is no clear "attack" nor way to brick or grief the protocol.
Agree with finding and severity
Handle
pauliax
Vulnerability details
Impact
Consider checking the actual amount transferred, e.g. in function addBounty as otherwise, you may have trouble with non-standard tokens, e.g. deflationary with a fee on transfer. The actual amount transferred is balanceOf the token before and after.
Recommended Mitigation Steps
uint256 before = IERC20(token).balanceOf(address(this)); token.safeTransferFrom(msg.sender, address(this), amount); uint256 after = IERC20(token).balanceOf(address(this)); amount = after - before;