Submitted by s1m0, also found by pauliax, shw, 0xRajeev, JMukesh, Lucius and cmichel
The smart contract doesnt check the return value of token.transfer() and token.transferFrom(), some erc20 token might not revert in case of error but return false.
In the TracerPerpetualSwaps:deposit and Insurance:deposit this would allow a user to deposit for free. See issue page for other places.
Recommend wrapping the call into a require() or using openzeppelins SafeERC20 library.
raymogg (Tracer) confirmed
