Escrow Static Analysis Findings

EWO-01S: Improper Invocation of EIP-20 transfer

Type	Severity	Location
Standard Conformity		Escrow.sol:L409

Description:

The linked statement does not properly validate the returned bool of the EIP-20 standard transfer function. As the standard dictates, callers must not assume that false is never returned.

Impact:

If the code mandates that the returned bool is true, this will cause incompatibility with tokens such as USDT / Tether as no such bool is returned to be evaluated causing the check to fail at all times. On the other hand, if the token utilized can return a false value under certain conditions but the code does not validate it, the contract itself can be compromised as having received / sent funds that it never did.

Example:

Copy
409IERC20Metadata(underlyingToken).transfer(to, bal);

Recommendation:

Since not all standardized tokens are EIP-20 compliant (such as Tether / USDT), we advise a safe wrapper library to be utilized instead such as SafeERC20 by OpenZeppelin to opportunistically validate the returned bool only if it exists.

Alleviation (d9eb549dcca601db1fa91336ebe4d08fa8f2908b):

The SafeERC20 library of the OpenZeppelin dependency is now properly imported to the codebase and its SafeERC20::safeTransfer function is correctly invoked in place of the potentially unhandled EIP-20 ERC20::transfer invocation, addressing this exhibit.