EverRise security record

When transferring deflationary ERC20 tokens, the input amount may not be equal to the received amount due to the charged transaction fee. For example, if a user sends 100 deflationary tokens (with a 10% transaction fee), only 90 tokens actually arrived to the contract. However, a failure to discount such fees may allow the same user to withdraw 100 tokens from the contract, which causes the contract to lose 10 tokens in such a transaction. Reference: https://thoreum-finance.medium.com/what-exploit-happened-today-for-gocerberus-and-garuda-also-for-lokum-ybear-piggy-caramelswap-3943ee23a39f ```solidity=258 IERC20(tokenAddress).transferFrom(msg.sender, address(this), amount); ``` - Transferring tokens by `amount`. ```solidity=259 _tokenBalances[tokenAddress][msg.sender] += amount; ``` - The `amount` appears to be used for bookkeeping purposes without compensating the potential transfer fees.

Addresses are not validated before assignment or external calls, potentially allowing the use of zero addresses and leading to unexpected behavior or vulnerabilities. For example, transferring tokens to a zero address can result in a permanent loss of those tokens. ```solidity=234 feeAddress = newAddress; ``` - `newAddress` is not zero-checked before being used. --- ```solidity=244 exchangeAddress = newAddress; ``` - `newAddress` is not zero-checked before being used. --- ```solidity=399 (bool success, ) = payable(to).call{value: amount}(""); ``` - `to` is not zero-checked before being used. --- ```solidity=419 (bool success, ) = payable(to).call{value: amount}(""); ``` - `to` is not zero-checked before being used. --- ```solidity=227 feeAddress = newAddress; ``` - `newAddress` is not zero-checked before being used. --- ```solidity=237 exchangeAddress = newAddress; ``` - `newAddress` is not zero-checked before being used. --- ```solidity=392 (bool success, ) = payable(to).call{value: amount}(""); ``` - `to` is not zero-checked before being used. --- ```solidity=412 (bool success, ) = payable(to).call{value: amount}(""); ``` - `to` is not zero-checked before being used.

Coda at the pointed location show some typos. - `whcih` should be `which`

The return values of the `transfer()` and `transferFrom()` calls in the smart contract are not checked. Some ERC-20 tokens' transfer functions return no values, while others return a bool value, they should be handled with care. If a function returns `false` instead of reverting upon failure, an unchecked failed transfer could be mistakenly considered successful in the contract. ```solidity=258 IERC20(tokenAddress).transferFrom(msg.sender, address(this), amount); ``` --- ```solidity=291 IERC20(tokenAddress).transfer(msg.sender, amount); ``` --- ```solidity=327 IERC20(tokenAddress).transfer(msg.sender, amount); ``` --- ```solidity=359 IERC20(tokenAddress).transfer(to, amount); ```