ERC20 transfer() may return nothing

[code423n4]

Lines of code

https://github.com/code-423n4/2022-10-holograph/blob/f8c2eae866280a1acfdc8a8352401ed031be1373/contracts/enforcer/PA1D.sol#L416
https://github.com/code-423n4/2022-10-holograph/blob/f8c2eae866280a1acfdc8a8352401ed031be1373/contracts/enforcer/PA1D.sol#L439

Vulnerability details

Impact

Some tokens do not comply with the standard. The transfer() function may have no return value, such as USDT. In such cases, the payout functions will revert and users fund may be locked.

Proof of Concept

// contracts/enforcer/PA1D.sol
416:    require(erc20.transfer(addresses[i], sending), "PA1D: Couldn't transfer token");
439:    require(erc20.transfer(addresses[i], sending), "PA1D: Couldn't transfer token");

Tools Used

Manual analysis.

Recommended Mitigation Steps

Use openzeppelin wrapper for ERC20 transfer.

[gzeoneth]

Duplicate of #456