ERC20 implementations are not always consistent. Some implementations of transferand transferFromcould return false on failure instead of reverting. It is safer to wrap such calls intorequire()statements to handle these failures.
The transfer call on L211 of transferOut() could be made on a user-supplied untrusted token address (from the different call sites) whose implementation can be malicious.
For reference, see similar finding from Consensys Diligence Audit of AAVE Protocol V2
Recommend requirements to check the return value and revert on0/falseor use OpenZeppelins SafeERC20 wrapper functions.
strictly-scarce (vader) disputed:
