Closed code423n4 closed 2 years ago
Czar102
ERC20 tokens may not revert on failure, instead return false. Users may lose their funds as ERC20 calls may fail. They are made to unknown ERC20 tokens that have no additional constraints on their failure reporting.
false
LaunchEvent.sol::458 => token.transfer(msg.sender, amount); LaunchEvent.sol::464 => pair.transfer(msg.sender, balance); LaunchEvent.sol::490 => token.transfer(msg.sender, amount); LaunchEvent.sol::514 => token.transfer(issuer, balance); LaunchEvent.sol::538 => token.transfer(penaltyCollector, excessToken); LaunchEvent.sol::543 => WAVAX.transfer(penaltyCollector, excessWavax); RocketJoeFactory.sol::133 => IERC20(_token).transferFrom(msg.sender, launchEvent, _tokenAmount); RocketJoeStaking.sol::184 => rJoe.transfer(_to, rJoeBal); RocketJoeStaking.sol::186 => rJoe.transfer(_to, _amount);
Manual analysis c4udit
Duplicate of #232
duplicate of #198
Handle
Czar102
Vulnerability details
Impact
ERC20 tokens may not revert on failure, instead return
false
. Users may lose their funds as ERC20 calls may fail. They are made to unknown ERC20 tokens that have no additional constraints on their failure reporting.Findings:
Tools used
Manual analysis c4udit