Skip to content

Latest commit

 

History

History
42 lines (24 loc) · 1.18 KB

083.md

File metadata and controls

42 lines (24 loc) · 1.18 KB
Raw

Spicy Nylon Cormorant

Medium

Unsafe usage of transferFrom in EthosReview.sol

Summary

Some ERC20 tokens do not revert on failure but instead, return false if their transfer/transferFrom functions fail. In the case that a payment token returns false on failure, users may be able to add reviews without transferring tokens.

Root Cause

In _handlePayment transferFrom is used to receive payment tokens:

IERC20(paymentToken).transferFrom(msg.sender, address(this), price);

Internal pre-conditions

  1. There is a mandatory payment fee when adding reviews

External pre-conditions

No response

Attack Path

  1. A token that does not revert on failure is added as a payment token.
  2. User adds a review using that token but their transfer fails.
  3. Even though they didn't transfer the token they successfully added the review, avoiding the necessary payment.

Impact

Users may be able to add reviews for free.

PoC

No response

Mitigation

Consider using Openzeppelin's SafeERC20 to transfer ERC20 tokens.