Tri-pathi - `_transferAmount` function of `Transfer` library doesn't check if enough value has been sent for transfer

[sherlock-admin2]

Tri-pathi

medium

_transferAmount function of Transfer library doesn't check if enough value has been sent for transfer

_transferAmount function of Transfer library doesn't check if enough value has been sent for transfer.

Vulnerability Detail

_transferAmount is an internal function which is transfer an amount of a token to an address. Token can be Native token or anyother ERC20 token. Which doesn't check if msg.value < amount and revert with AMOUNT_MISMATCH() like the other helper function of same library. This function has been used at many places for transferring tokens

File: contracts/core/libraries/Transfer.sol
    function _transferAmount(address _token, address _to, uint256 _amount) internal {
        if (_token == NATIVE) {
            SafeTransferLib.safeTransferETH(_to, _amount);
        } else {
            SafeTransferLib.safeTransfer(_token, _to, _amount);
        }
    }

https://github.com/allo-protocol/allo-v2/blob/0b881ef4a0013d2809374c9ea69f4cf1288dfe62/contracts/core/libraries/Transfer.sol#L87

it doesn't check if msg.value<amount for transferring Native tokens.

Impact

Unexpected error scenario and tx will revert

Code Snippet

Tool used

Manual Review

Recommendation

add a check and revert with AMOUNT_MISMATCH() like the other helper functions

[sherlock-admin]

1 comment(s) were left on this issue during the judging contest.

n33k commented:

invalid, caller of _transferAmount makes checkes