_payoutToken[s]() is not compatible with ERC20-tokens which revert on zero value transfer

[code423n4]

Lines of code

https://github.com/code-423n4/2022-10-holograph/blob/f8c2eae866280a1acfdc8a8352401ed031be1373/src/enforcer/PA1D.sol#L317
https://github.com/code-423n4/2022-10-holograph/blob/f8c2eae866280a1acfdc8a8352401ed031be1373/src/enforcer/PA1D.sol#L340

Vulnerability details

Impact

Payout is blocked.

Proof of Concept

PA1D._payoutToken() and PA1D._payoutTokens() call ERC20.transfer() to send tokens to a list of payout recipients.
Some tokens (e.g. LEND) revert when transferring a zero value amount. If one of the recipients is to receive a zero amount of such a token, then the entire transaction will revert and the payout cannot be made.

Tools Used

Code inspection

Recommended Mitigation Steps

Only attempt to transfer to a recipient if the amount (sending) is greater than zero.

[gzeoneth]

can be checked offchain, risk is relatively low

[alexanderattar]

Low severity. We can add a check just in case

[ACC01ADE]

Duplicate of #456

[gzeoneth]

Duplicate of #456

While not exactly a duplicate, I agree to consolidate all issue regarding ERC20 incompatibility into 1 Med risk issue.