search

code-423n4 / 2022-10-thegraph-findings

0 stars 0 forks source link

Return value of `transferFrom()` not checked #176

Closed code423n4 closed 1 year ago

code423n4 commented 1 year ago

Lines of code

https://github.com/code-423n4/2022-10-thegraph/blob/309a188f7215fa42c745b136357702400f91b4ff/contracts/gateway/L1GraphTokenGateway.sol#L235 https://github.com/code-423n4/2022-10-thegraph/blob/309a188f7215fa42c745b136357702400f91b4ff/contracts/gateway/L1GraphTokenGateway.sol#L276

Vulnerability details

Impact

When there’s a failure in transfer()/transferFrom() the function signature has a boolean return value and they indicate errors that way instead. By not checking the return value, operations that should have marked as failed, may potentially go through without actually transfer the token. The fund could be lost.

Proof of Concept

// gateway/L1GraphTokenGateway.sol
235:    token.transferFrom(from, escrow, _amount);
276:    token.transferFrom(escrow, _to, _amount);

Tools Used

Manual analysis.

Recommended Mitigation Steps

Add return value checks.