Unchecked ERC20 transfer return value

Severity: High ID: erc20-unchecked-transfer

Flags calls to ERC20 transfer and transferFrom where the boolean return value is ignored.

What it does

Warns when a function with the same signature as transfer(address,uint256) or transferFrom(address,address,uint256) and a bool return type is invoked but the result is not checked.

Why is this bad?

The ERC20 spec allows tokens to signal failure by returning false instead of reverting. Ignoring the return value lets a "failed" transfer go unnoticed, allowing accounting to drift and creating common DeFi exploits. Use a wrapper such as OpenZeppelin's SafeERC20 or check the boolean explicitly.

Example

Bad

solidity

token.transfer(to, amount);
token.transferFrom(from, to, amount);

Good

solidity

require(token.transfer(to, amount), "transfer failed");
require(token.transferFrom(from, to, amount), "transferFrom failed");

// or use SafeERC20
SafeERC20.safeTransfer(token, to, amount);

Notes

This lint can produce false positives when the callee does not strictly conform to the ERC20 interface (e.g. tokens that revert on failure rather than returning false).