Usage of idea proposal EIP-677

[code423n4]

Lines of code

https://github.com/code-423n4/2023-04-frankencoin/blob/f86279e76fd9f810d2a25243012e1be4191a547e/contracts/ERC20.sol#L161
https://github.com/code-423n4/2023-04-frankencoin/blob/f86279e76fd9f810d2a25243012e1be4191a547e/contracts/StablecoinBridge.sol#L75
https://github.com/code-423n4/2023-04-frankencoin/blob/f86279e76fd9f810d2a25243012e1be4191a547e/contracts/Equity.sol#L241

Vulnerability details

Impact

According to https://eips.ethereum.org/erc, the ERC-677 standard used in the project is not included in the Final, Last Call list of standards (This standard is an Idea and not a standard), which leads to the fact that a standard is used which has not been approved/deprecated or removed

Consequences:

• this is not a standard
• it can change
• there are no clear requirements
• truncated functionality as transferFromAndCall

Proof of Concept

Links to the code:

• ERC20.sol#L161-L168

• IERC677Receiver.sol

• StablecoinBridge.sol

• Equity.sol
  Links on the resource side:

• https://eips.ethereum.org/all

• ERC: transferAndCall Token Standard ethereum/EIPs#677

• https://eips.ethereum.org/EIPS/eip-1363

• https://eips.ethereum.org/

Tools Used

• Manual review

Recommended Mitigation Steps

• The idea of EIP-677 has been refined and now https://eips.ethereum.org/EIPS/eip-1363 has appeared which can be used

[c4-pre-sort]

0xA5DF marked the issue as low quality report

[0xA5DF]

Might be a QA, no significant impact is demonstrated

[c4-judge]

hansfriese changed the severity to QA (Quality Assurance)

[c4-judge]

hansfriese marked the issue as grade-b