search

code-423n4 / 2022-05-rubicon-findings

5 stars 2 forks source link

Upgraded Q -> M from 220 [1656128478013] #469

Closed code423n4 closed 2 years ago

code423n4 commented 2 years ago

Judge has assessed an item in Issue #220 as Medium risk. The relevant finding follows:

HickupHH3 commented 2 years ago

Unchecked return value of transfer() and transferFrom() in RubinconRouter.sol The smart contract does not check the return value for transfer() and transferFrom() in different functions in the contract. Occurrences are in: BathToken._withdraw() - https://github.com/code-423n4/2022-05-rubicon/blob/main/contracts/rubiconPools/BathToken.sol#L602 BathToken.rebalance() - https://github.com/code-423n4/2022-05-rubicon/blob/main/contracts/rubiconPools/BathToken.sol#L353 BathToken.rebalance() - https://github.com/code-423n4/2022-05-rubicon/blob/main/contracts/rubiconPools/BathToken.sol#L357 BathToken._withdraw() - https://github.com/code-423n4/2022-05-rubicon/blob/main/contracts/rubiconPools/BathToken.sol#L605 BathToken._deposit() - https://github.com/code-423n4/2022-05-rubicon/blob/main/contracts/rubiconPools/BathToken.sol#L565

Recommendations: Wrap the call into a require() or use openzeppelin's SafeERC20 library.

dup of #316