# Erc20Utils::safeTransferFrom() assumes the tokens are transferred to this, which may not be the case Low/Info · Three Sigma · Social money games · 13th June, 2024 Finding 3S-D1-N01 of the DistrictOne security review. - Protocol: https://districtone.io/ - Report: /reports/districtone - Source: https://cdn.sanity.io/files/qoqld077/production/fd2142f1d189dd29db23dff49d4018d4da9c01d6.pdf --- ### Description Erc20Utils::safeTransferFrom() checks the balance of address(this) before and after transferring, but it may transfer the tokens to a different address, in which case it would always return 0. The function is not used in the codebase but may be in the future. ### Recommendation The balances should be checked of the to address, not address(this). ### Status Acknowledged --- Related findings: - [`uniTransfer()` limits the gas limit to 5k in outdated 1inch solidity-utils lib](https://0xsimao.com/findings/1inch-uni-transfer-gas-1inch): 1inch Fee Extension - [Missing several `safeERC20` functions](https://0xsimao.com/findings/beraborrow-i-several-safe-erc20-functions): Beraborrow Managed Dens - [Throughout code base, implement using SafeERC20 for IERC20 for better readability](https://0xsimao.com/findings/fuji-finance-erc20-ierc20-better-readability): Fuji Finance - [Codebase is not using SafeERC20](https://0xsimao.com/findings/metazero-ii-codebase-safe-erc20): MetaZero Staking