Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

bareli - use safetransfer instead of transfer #315

Open
sherlock-admin2 opened this issue Nov 4, 2024 · 0 comments
Open

bareli - use safetransfer instead of transfer #315

sherlock-admin2 opened this issue Nov 4, 2024 · 0 comments
Labels
Sponsor Confirmed The sponsor acknowledged this issue is valid Won't Fix The sponsor confirmed this issue will not be fixed

Comments

@sherlock-admin2
Copy link
Contributor

sherlock-admin2 commented Nov 4, 2024

bareli

Medium

use safetransfer instead of transfer

Summary

not all ERC20 tokens return or revert on transfer it may cause the token to be struck .

Root Cause

https://github.com/sherlock-audit/2024-10-ethos-network/blob/main/ethos/packages/contracts/contracts/EthosReview.sol#L449
function withdrawFunds(address paymentToken) external onlyOwner {
if (paymentToken == address(0)) {
payable(msg.sender).transfer(address(this).balance);
} else {
IERC20(paymentToken).transfer(msg.sender, IERC20(paymentToken).balanceOf(address(this)));
}
}

Internal pre-conditions

No response

External pre-conditions

No response

Attack Path

No response

Impact

tokens may get struck .

PoC

No response

Mitigation

use safe transfer and safetransferfrom.

@sherlock-admin4 sherlock-admin4 changed the title Large Amber Camel - use safetransfer instead of transfer bareli - use safetransfer instead of transfer Nov 20, 2024
@sherlock-admin3 sherlock-admin3 added Won't Fix The sponsor confirmed this issue will not be fixed Sponsor Confirmed The sponsor acknowledged this issue is valid labels Nov 27, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Sponsor Confirmed The sponsor acknowledged this issue is valid Won't Fix The sponsor confirmed this issue will not be fixed
Projects
None yet
Development

No branches or pull requests

2 participants