0xjoi - M-6 Solmate's SafeTransferLib does not check for token contract's existence

[sherlock-admin3]

0xjoi

Medium

M-6 Solmate's SafeTransferLib does not check for token contract's existence

Summary

Vulnerability Detail

There is a subtle difference between the implementation of solmate’s SafeTransferLib and OZ’s SafeERC20: OZ’s SafeERC20 checks if the token is a contract or not, solmate’s SafeTransferLib does not. https://github.com/transmissions11/solmate/blob/main/src/utils/SafeTransferLib.sol#L9 @dev Note that none of the functions in this library check that a token has code at all! That responsibility is delegated to the caller

Impact

Code Snippet

Instances (2):

File: libs/ERC1155Bridgable.sol

132:                 SafeTransferLib.safeTransfer(token, _recipient, token.balanceOf(address(this)));

File: libs/ERC721Bridgable.sol

159:                 SafeTransferLib.safeTransfer(token, _recipient, token.balanceOf(address(this)));

Tool used

Manual Review

Recommendation