hats-finance / Tapioca--Lending-Engine--0x5bee198f5b060eecd86b299fdbea6b0c07c728dd

Other
0 stars 0 forks source link

unsafe token transfer #30

Open hats-bug-reporter[bot] opened 5 months ago

hats-bug-reporter[bot] commented 5 months ago

Github username: @Jelev123 Twitter username: zhulien_zhelev Submission hash (on-chain): 0x4c103a344a9b8542feb10aee41f91742ae97b868698ffe187f57b1a95be1a291 Severity: medium

Description: Description\ The current implementation of the _withdrawExercised function includes a potential vulnerability in the else clause when handling token transfers on the same chain. Specifically, the tapBalance is not checked before calling safeTransfer. If tapBalance is zero, this operation will revert

  1. Proof of Concept (PoC) File

https://github.com/hats-finance/Tapioca--Lending-Engine--0x5bee198f5b060eecd86b299fdbea6b0c07c728dd/blob/8920782db6044643fd0c682f58ef37f7e59f99b1/contracts/usdo/modules/UsdoOptionReceiverModule.sol#L207

Recommendation check tapBalance for zero before safeTransfer

else {
            //send on this chain
            if(tapBalance > 0) {
            IERC20(tapOft).safeTransfer(msg_.optionsData.from, tapBalance);
           }
        }