Unsafe transfer in RocketJoeFactory

[code423n4]

Handle

0x1f8b

Vulnerability details

Impact

Unsafe transferFrom.

Proof of Concept

In the method RocketJoeFactory.createRJLaunchEvent it's made one transferFrom without checking the boolean result, ERC20 standard specify that the token can return false if the transfer was not made, so it's mandatory to check the result of transfer methods.

Affected line: RocketJoeFactory:132

Tools Used

Manual review.

Recommended Mitigation Steps

Check the boolean result.

[cryptofish7]

Duplicate of #12

[dmvt]

This could result in a loss of funds given the right external conditions.

2 — Med (M): vulns have a risk of 2 and are considered “Medium” severity when assets are not at direct risk, but the function of the protocol or its availability could be impacted, or leak value with a hypothetical attack path with stated assumptions, but external requirements.