FactoryDAO contest - ych18's results

Lines of code

https://github.com/code-423n4/2022-05-factorydao/blob/main/contracts/MerkleDropFactory.sol#L107

Vulnerability details

This issue is omnipresented in the project:

Although the ERC20 standard suggests that a transfer should return true on success, many tokens are non-compliant in this regard (including high profile, like USDT) . In that case, the transfer()/transferFrom() call will revert even if the transfer is successful, because solidity will check that the RETURNDATASIZE matches the ERC20 interface.

Recommendation: Consider using OpenZeppelin’s SafeERC20.

Lines of code

https://github.com/code-423n4/2022-05-factorydao/blob/main/contracts/PermissionlessBasicPoolFactory.sol#L169 https://github.com/code-423n4/2022-05-factorydao/blob/main/contracts/PermissionlessBasicPoolFactory.sol#L282

Vulnerability details

• Some tokens have a decimals != 18 (including high profile, like USDC where decimals = 6). getMaximumRewards() and getRewards() functions would not calculate the right amount of these tokens because these functions divide the amount of token by 1e18 whereas the tokens with decimals==6 should be divided by 1e6

Recommendation: divide the wei amount of token by 1/e(token.decimals()) to have the correct amount of token.