Skip to content
Request an audit

‹ Findings database

Erc20Utils::safeTransferFrom() assumes the tokens are transferred to this, which may not be the case

Low/InfoDistrictOne audit·Three Sigma·Social money games·13th June, 20243S-D1-N01

Description

Erc20Utils::safeTransferFrom() checks the balance of address(this) before and after transferring, but it may transfer the tokens to a different address, in which case it would always return 0. The function is not used in the codebase but may be in the future.

Recommendation

The balances should be checked of the to address, not address(this).

Status

Acknowledged

Source

Disclosed by 0xSimao · Sherlock's 2025 Watson of the Year · 21 first places in 57 audit contests