Submitted by 0xSmartContract, also found by 0xDecorativePineapple, berndartmueller, brgltd, Jeiwan, kaden, and rbserver
TransferHelper.sol#L21
The safeTransfer function does not check for the existence of the ERC20 token contract , TransferHelper.sol performs a transfer with a low-level call without confirming the contracts existence
The low-level functionscall,delegatecallandstaticcallreturntrueas their first return value if the account called is non-existent, as part of the design of the EVM. Account existence must be checked prior to calling if needed.
It allows malicious people to pair with a qualified token like ETH with [dubious] tokens that they can destroy later, and most importantly, to run the safeTransfer function even if the token contract is later destroyed.
1 Alice creates a pair of A and B Tokens (For exampleETH - TestToken Pair).
The creator and only owner of TestToken is Alice.
2 Next, Alice destroys the TestToken with a Selfdestruct based on onlyowner privilege.
3 Bob, unaware of this, deposits ETH into the pool to trade from the ETH-TestToken pair, but cannot receive any tokens because safeTransfer does not check for the existence of the contract.
Have the SafeTransfer function check the existence of the contract before every transaction.
0xean (judge) decreased severity to Medium and commented:
sameepsi (QuickSwap & StellaSwap) disputed and commented:
0xean (judge) commented:
