# Usage of transferFrom() could revert if used from itself Low/Info · Three Sigma · Liquid staking · 12th July, 2023 Finding 3S-GLACIER-N01 of the Glacier security review. - Protocol: https://www.glacier.io/ - Report: /reports/glacier - Source: https://cdn.sanity.io/files/qoqld077/production/21bd3b6fa78c55968a6c9c7ea4fd49f34a8bd3d8.pdf --- ### Description Under normal circumstances the usage of transferFrom() in the function withdraw() in [AaveV3Strategy](https://github.com/JackFrostDev/glacier-contracts/blob/main/contracts/protocol/ReservePool/strategies/AaveV3Strategy.sol#L81) and in [GReservePool](https://github.com/JackFrostDev/glacier-contracts/blob/main/contracts/protocol/ReservePool/GReservePool.sol#L207) would revert as it would be necessary for the contract to approve itself. When transferring its own funds it should use .call() instead. WAVAX does not revert in this instance but other tokens would. ### Status Currently being reviewed by the team. --- Related findings: - [API3 oracle timestamp can be set to future timestamp and block API3 Oracle usage to make code revert in underflow](https://0xsimao.com/findings/init-capital-ii-oracle-timestamp-revert-underflow): INIT Capital - [Potential ETH Loss Due to transfer Usage in Requestor Contract on `zkSync`](https://0xsimao.com/findings/pooltogether-the-prize-layer-for-defi-eth-transfer-requestor-sync): PoolTogether Prize Layer - [_crossTransfer(...) should revert if users specify routerByDomain[destDomain] as destination](https://0xsimao.com/findings/fuji-finance-transfer-revert-specify-dest): Fuji Finance - [Using transfer() instead of call() may revert](https://0xsimao.com/findings/ostium-transfer-instead-call-revert): Ostium