Skip to content
Request an audit

‹ Findings database

Usage of transferFrom() could revert if used from itself

Low/InfoGlacier audit·Three Sigma·Liquid staking·12th July, 20233S-GLACIER-N01

Description

Under normal circumstances the usage of transferFrom() in the function withdraw() in AaveV3Strategy and in GReservePool would revert as it would be necessary for the contract to approve itself.

When transferring its own funds it should use .call() instead. WAVAX does not revert in this instance but other tokens would.

Status

Currently being reviewed by the team.

Source

Disclosed by 0xSimao · Sherlock's 2025 Watson of the Year · 21 first places in 57 audit contests