# Codebase is not using SafeERC20 Low/Info · Three Sigma · Omnichain RWA tokenisation · 6th April, 2024 Finding 3S-MZ-N05 of the MetaZero Staking security review. - Protocol: https://metazero.gg/ - Report: /reports/metazero-ii - Codebase: https://github.com/0xsimao/stakingContract/tree/dffac73e838a9fbd12bed18e41b9799177bcde7f - Source: https://cdn.sanity.io/files/qoqld077/production/3e07b0c2806b62578b8031e88c59bc5dbd38de1b.pdf --- ### Description The codebase is using transferFrom() and transfer() which revert for weird ERC20 tokens. It should not happen as the MetaZero token implements the standard [correctly](https://etherscan.io/address/0x328a268b191ef593b72498a9e8a481c086eb21be#code). ### Recommendation Use [SafeERC20::safeTransferFrom()](https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/token/ERC20/utils/SafeERC20.sol#L44) and [SafeERC20::safeTransfer()](https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/token/ERC20/utils/SafeERC20.sol#L36) instead. ### Status Acknowledged --- Related findings: - [Missing several `safeERC20` functions](https://0xsimao.com/findings/beraborrow-i-several-safe-erc20-functions): Beraborrow Managed Dens - [Erc20Utils::safeTransferFrom() assumes the tokens are transferred to this, which may not be the case](https://0xsimao.com/findings/districtone-erc20-utils-transfer-transferred): DistrictOne - [Throughout code base, implement using SafeERC20 for IERC20 for better readability](https://0xsimao.com/findings/fuji-finance-erc20-ierc20-better-readability): Fuji Finance