Submitted by shw
Tokens not compliant with the ERC20 specification could return false from the transfer function call to indicate the transfer fails, while the calling contract would not notice the failure if the return value is not checked. Checking the return value is a requirement, as written in the EIP-20 specification:
See ERC20Rewards.sol L175.
Recommend using the SafeERC20 library implementation from OpenZeppelin and calling safeTransfer or safeTransferFrom when transferring ERC20 tokens.
alcueca (Yield) confirmed and patched:
