BAHOZ - Return of arbitrary ERC20 transfer is not checked in escrow

[sherlock-admin]

BAHOZ

medium

Return of arbitrary ERC20 transfer is not checked in escrow

Summary

The return value of erc20.transfer call in transferERC20() is not checked.

Vulnerability Detail

Several tokens do not revert in case of transfer failure and return false instead. If one of these tokens is used here, although transfer fails, transferERC20() will not revert. Moreover, the return value is not returned to the caller, which makes it impossible to handle this issue in case it is called by another contract that expects a successful transfer.

Impact

Depending on where the function is called from, the impact can be quite severe.

Code Snippet

https://github.com/sherlock-audit/2023-04-footium/blob/main/footium-eth-shareable/contracts/FootiumEscrow.sol#L110

Tool used

Static Analysis

Recommendation

Require the return value of the transfer to be true or use OZ's SafeERC20 wrapper for ERC20 tokens.

Duplicate of #86

[sherlock-admin]

Escalate for 10 USDC

This should be dup of #14

You've deleted an escalation for this issue.