Polaris_tow - Use safeTransfer/safeTransferFrom consistently instead of transfer/transferFrom

[sherlock-admin]

Polaris_tow

medium

Use safeTransfer/safeTransferFrom consistently instead of transfer/transferFrom

Summary

Use safeTransfer/safeTransferFrom consistently instead of transfer/transferFrom

Vulnerability Detail

Some tokens do not revert on failure, but instead return false (e.g. ZRX).
https://github.com/d-xo/weird-erc20/#no-revert-on-failure
tranfser/transferfrom is directly used to send tokens in many places in the contract and the return value is not checked.
If the token send fails, it will cause a lot of serious problems.
For example,

    function claimERC20Prize(
      address _to,
      IERC20Upgradeable _token,
      uint256 _amount,
      bytes32[] calldata _proof
  ) external whenNotPaused nonReentrant {
      if (_to != msg.sender) {
          revert InvalidAccount();
      }

      if (
          !MerkleProofUpgradeable.verify(
              _proof,
              erc20MerkleRoot,
              keccak256(abi.encodePacked(_token, _to, _amount))
          )
      ) {
          revert InvalidERC20MerkleProof();
      }

      uint256 value = _amount - totalERC20Claimed[_token][_to];

      if (value > 0) {
          totalERC20Claimed[_token][_to] += value;
          _token.transfer(_to, value);
      }

      emit ClaimERC20(_token, _to, value);
  }

Impact

If the token send fails, it will cause a lot of serious problems, the return value is not checked.

Code Snippet

https://github.com/sherlock-audit/2023-04-footium/blob/main/footium-eth-shareable/contracts/FootiumEscrow.sol#L105-L111
https://github.com/sherlock-audit/2023-04-footium/blob/main/footium-eth-shareable/contracts/FootiumPrizeDistributor.sol#L106-L134

Tool used

Manual Review

Recommendation

Consider using safeTransfer/safeTransferFrom consistently.

Duplicate of #86