search

hats-finance / Fenix--0x9d7765a7ebd5b6322a30797a44a5428531970d3d

0 stars 1 forks source link

missing check for 0 amount #26

Open hats-bug-reporter[bot] opened 3 months ago

hats-bug-reporter[bot] commented 3 months ago

Github username: @Jelev123 Twitter username: zhulien_zhelev Submission hash (on-chain): 0x4da96444a2869757dd249176b0e9b2dede027bcd395af977e99c89f4b4a2a88b Severity: medium

Description: Description\ In erc20Recover is used safeTransfer. But some tokens revert when transferring a zero value amount.

  1. Proof of Concept (PoC) File https://github.com/hats-finance/Fenix--0x9d7765a7ebd5b6322a30797a44a5428531970d3d/blob/bacfa45049a5d0f5c08a9dc479cddaaeb27bccbd/contracts/nest/CompoundVeFNXManagedNFTStrategyUpgradeable.sol#L166

Recommendation

require(amount > 0 ); before IERC20(token_).safeTransfer(recipient_, amount);

0xmahdirostami commented 3 months ago

Why do you want to transfer zero token?

non-standard ERC20 tokens are OOS, Invalid

Jelev123 commented 3 months ago

Sorry, but what it means OOS

0xmahdirostami commented 3 months ago

non-standard ERC20 tokens are OOS

OOS (out of scope)

And btw, what is the impact of the issue? You couldn't transfer 0 tokens?

Jelev123 commented 3 months ago

It wouldn`t recover if send 0 amount