0xnirlin - transferERC20 function in FootiumEscrow contract may not work as expected.

[sherlock-admin]

0xnirlin

medium

transferERC20 function in FootiumEscrow contract may not work as expected.

Summary

footium escrow contract uses erc20 transfer method for transferring tokens which may not work for weird erc20 implementations that are standard compliant but work bit different.

Vulnerability Detail

Consider a token like ZRX that do not revert on failed transfer but rather returns a boolean as false so it needs to be checked to confirm the transaction. Such tokens can cause unexpected behavious in escrow contract.

Impact

transaction will proceed without transferring the tokens.

Code Snippet

https://github.com/sherlock-audit/2023-04-footium/blob/main/footium-eth-shareable/contracts/FootiumEscrow.sol#L105-L111

Tool used

Manual Review

Recommendation

use openzeppelin safe transfer library.

Duplicate of #86