Solmate's SafeTransferLib
When utilizing Solmate's SafeTransferLib, it's important to acknowledge that the library lacks inherent verification of a contract's existence at the token address.
This oversight can lead to significant risks, especially in scenarios where token addresses may not correspond to deployed contracts. Such vulnerabilities could result in silent operation failures and potentially enable exploitation akin to known honeypot attacks.
For example, consider a contract featuring a mechanism to lock and subsequently unlock tokens based on specific conditions. If this contract fails to validate the existence of the token contract at the designated address, an attacker could exploit this weakness. They might manipulate the system by locking tokens in anticipation of a future deployment of the token contract to the specified address. Once the token contract is deployed, the attacker can unlock and exploit the vulnerability to claim tokens without having legitimately locked them. z
Consider checking that the token contract exists, e.g. by:
