Assuming tokens are compliant with ERC20 could cause transactions to revert unexpectedly

[code423n4]

Handle

shw

Vulnerability details

Impact

In the following lines of code, when transferring tokens, it is assumed that the token complies with the standard ERC20 interface (since the OpenZeppelin IERC20 is used). However, for tokens that do not have a return value of transfer or transferFrom (e.g., USDT and BNB) the function calls transfer and transferFrom reverts due to a return value decoding error.

Proof of Concept

Referenced code:
LongShort.sol#L791
YieldManagerAave.sol#L132

Recommended Mitigation Steps

Use the SafeERC20 library implementation from OpenZeppelin, which handles tokens that have no return values of transfer and transferFrom.

[JasoonS]

Loose duplicate: #13, #140 (and a few other similar issues)

This is explained in the readme. We will ONLY use DAI.

[0xean]

Based on the readme, I am going to downgrade this to non critical.