QA Report - Githubissues

code423n4 commented 2 years ago

1. Check for zero `tokenBalance` before `depositTokens()`

-In MerkleDropFactory.sol#L59, tokenBalance can be check with require(tokenBalance) > 0 to stop zero depoist.

2. ERC20 transfer return value not checked

In MerkleVesting.sol#L173, return value of the erc20 transfer should be checked for boolean value to revert on false returned by some tokens.

# Before 
IERC20(tree.tokenAddress).transfer(destination, currentWithdrawal);

# After
require(IERC20(tree.tokenAddress).transfer(destination, currentWithdrawal), "fail message");

illuzen commented 2 years ago

valid
duplicate

gititGoro commented 2 years ago

Note on 2. Not all ERC20 tokens return a boolean. It's safer to perform a low level call and assert that it passed. And even safer to use a battle tested library to do this for you.

code-423n4 / 2022-05-factorydao-findings

QA Report #104

1. Check for zero `tokenBalance` before `depositTokens()`

2. ERC20 transfer return value not checked

code-423n4 / 2022-05-factorydao-findings

QA Report #104

1. Check for zero tokenBalance before depositTokens()

2. ERC20 transfer return value not checked

1. Check for zero `tokenBalance` before `depositTokens()`