External call does not have amount check in TransferHelper

[code423n4]

Handle

defsec

Vulnerability details

Impact

There is occurrence in the code of the TransferHelper contract where amount is checked after the external call.

Proof of Concept

• Navigate to TransferHelper.sol
• Amount is checked after an external call. TransferHelper.sol amount check
• To favor readability and avoid confusions, consider applying check at the beginning of function.

Tools Used

None

Recommended Mitigation Steps

To favor readability and avoid confusions, consider applying check at the beginning of function.

  function _safeTransferFrom(address _token, address _sender, uint _amount) internal virtual {
    require(_amount > 0, "TransferHelper: amount must be > 0");
    ...
  }

[talegift]

Readability issues should IMO be marked as 0 (non-critical).

[ghoul-sol]

This is gas optimization since I don't see any exploit.