Skip to content

FLOW-4: ERC20 transfer failure creates permanently failing request #19

@liobrasil

Description

@liobrasil

Severity: Medium

Files Affected

  • cadence/contracts/FlowYieldVaultsEVM.cdc:1280-1283

Description

When bridging ERC20 tokens via bridgeERC20ToEVM, transfer failures cause panics. For WITHDRAW/CLOSE operations, if the ERC20 transfer persistently fails (recipient blacklisted, token paused), Flow's cross-VM atomicity reverts startProcessing, but every retry fails identically.

The request becomes permanently unprocessable, blocking the user's funds and queue slot.

Recommendation

Handle ERC20 transfer failures gracefully. Return funds to escrow and mark request as failed rather than creating an infinite retry loop.


Parent Issue: #15

Metadata

Metadata

Assignees

Labels

MediumMedium severity security finding⎈ QuantStampQuantStamp audit finding

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions