Handsome Pineapple Mustang
Medium
The return value of the transfer is not checked so it is possible that the transfer fails silently (returning a false ) and the rest of the function executes normally . In that case token balances and fees would be updated without any transfer taking place.
https://github.com/sherlock-audit/2024-11-debita-finance-v3/blob/main/Debita-V3-Contracts/contracts/DebitaIncentives.sol#L203 uint amountToClaim = (lentIncentive * porcentageLent) / 10000; amountToClaim += (borrowIncentive * porcentageBorrow) / 10000;
IERC20(token).transfer(msg.sender, amountToClaim);
emit ClaimedIncentives(
msg.sender,
principle,
token,
amountToClaim,
epoch
https://github.com/sherlock-audit/2024-11-debita-finance-v3/blob/main/Debita-V3-Contracts/contracts/DebitaIncentives.sol#L269 // transfer the tokens IERC20(incentivizeToken).transferFrom( msg.sender, address(this), amount );
No response
No response
No response
transfer of tokens will not happen.
No response
Use safeTransfer or check the return value of the transfer