Submitted by cmichel
The TokenHandler.safeTransferOut function uses the standard IERC20 function for the transfer call and proceeds with a checkReturnCode function to handle non-standard compliant tokens that dont return a return value.
However, this does not work, as calling token.transfer(account, amount) already reverts if the token does not return a return value, as tokens IERC20.transfer is defined to always return a boolean.
The impact is that, when using any non-standard compliant token like USDT, the function will revert.
Deposits for these tokens are broken, which is bad as USDT is a valid underlying for the cUSDT cToken.
We recommend using OpenZeppelins SafeERC20 versions with the safeApprove function that handles the return value check as well as non-standard-compliant tokens.
jeffywu (Notional) confirmed
