Incorrect check for successful token transfer

[code423n4]

Lines of code

https://github.com/code-423n4/2022-10-holograph/blob/f8c2eae866280a1acfdc8a8352401ed031be1373/contracts/enforcer/PA1D.sol#L439-L440

Vulnerability details

Impact

The parameter tokenAddress of _payoutToken/_payoutTokens can be any token.
According to https://github.com/d-xo/weird-erc20/#missing-return-values, some tokens have no return value when transferred, so in the _payoutToken/_payoutTokens functions, even if the transfer is successful, since there is no return value, the return value will be considered false, causing the function to not work, thereby locking these tokens in the contract

Proof of Concept

https://github.com/code-423n4/2022-10-holograph/blob/f8c2eae866280a1acfdc8a8352401ed031be1373/contracts/enforcer/PA1D.sol#L416-L417
https://github.com/code-423n4/2022-10-holograph/blob/f8c2eae866280a1acfdc8a8352401ed031be1373/contracts/enforcer/PA1D.sol#L439-L440

Tools Used

None

Recommended Mitigation Steps

Using safeTransfer

    function safeTransfer(address token, address to, uint256 value) internal {
        require(token.code.length > 0);
        (bool success, bytes memory data) =
        token.call(abi.encodeWithSelector(IERC20.transfer.selector, to, value));
        require(success && (data.length == 0 || abi.decode(data, (bool))));
    }

[gzeoneth]

Duplicate of #456