token-integration-safety

Token Integration Safety

Always Use SafeERC20

This is the single most important rule. Never call transfer, transferFrom, or approve directly.

import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {SafeERC20} from "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";

contract Vault {
    using SafeERC20 for IERC20;

    function deposit(IERC20 token, uint256 amount) external {
        token.safeTransferFrom(msg.sender, address(this), amount);
    }

    function withdraw(IERC20 token, uint256 amount) external {
        token.safeTransfer(msg.sender, amount);
    }

    function approve(IERC20 token, address spender, uint256 amount) external {
        token.forceApprove(spender, amount);
    }
}

USDT — No Return Value

USDT's transfer() and transferFrom() don't return a bool. Direct calls via the IERC20 interface will revert because Solidity expects return data.

// BROKEN with USDT:
IERC20(usdt).transfer(to, amount); // reverts — no return data

// WORKS with USDT:
IERC20(usdt).safeTransfer(to, amount); // SafeERC20 handles missing return

USDT also requires approval to be set to 0 before changing to a non-zero value:

// BROKEN with USDT:
IERC20(usdt).approve(spender, newAmount); // reverts if current approval != 0

// WORKS with USDT:
IERC20(usdt).forceApprove(spender, newAmount); // sets to 0 first, then newAmount

USDC — 6 Decimals and Blacklist

// USDC uses 6 decimals, not 18
// 1 USDC = 1_000_000 (1e6), NOT 1e18

// VULNERABLE: hardcoded 18 decimals
uint256 usdcAmount = ethAmount * ethPrice / 1e18; // wrong!

// SAFE: use actual decimals
uint8 decimals = IERC20Metadata(address(usdc)).decimals(); // returns 6
uint256 usdcAmount = ethAmount * ethPrice / (10 ** (18 - decimals + 18));

USDC has a blacklist. Blacklisted addresses cannot send or receive USDC. Your protocol must handle transfer failures gracefully.

// If a blacklisted user has funds in your vault, they cannot withdraw
// Consider: allow withdrawal to a different address (with proper auth)
function withdrawTo(address token, address recipient, uint256 amount) external {
    if (balances[msg.sender] < amount) revert InsufficientBalance();
    balances[msg.sender] -= amount;
    IERC20(token).safeTransfer(recipient, amount);
}