# TokenHandler.safeTransferIn does not work on non-standard compliant tokens like USDT

TokenHandler.safeTransferIn calls IERC20.transferFrom which reverts on non-returning tokens like USDT, breaking withdrawals for USDT-backed cTokens.

- Payout: Audit contest
- Severity: high
- Program: Notional
- Found by: cmichel
- Disclosed: 2021-10-01
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-08-notional-findings/issues/80
- Library page: https://bugbountylibrary.com/r/c4%3A2021-08-notional%3AH-07
- Tags: area:web3 domain:web3 impact:dos kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:dos

**Target:** TokenHandler.safeTransferIn / ERC20 transfer handling
**Root cause:** The code calls token.transferFrom via the standard IERC20 interface, which is declared to return bool; tokens like USDT return no data, so the call reverts before checkReturnCode can handle it.
**Steps:**
1. Identify TokenHandler.safeTransferIn using IERC20.transferFrom plus a checkReturnCode helper.
2. Use a non-standard token like USDT whose transferFrom returns no boolean.
3. Call the withdrawal path for a USDT-backed cToken; the transferFrom call reverts.
4. Withdrawals for these tokens are broken.
**How found:** Code review of the transfer helper: noticed checkReturnCode was intended to handle non-returning tokens but the preceding IERC20.transferFrom call already reverts on such tokens.
**Insight:** A return-code check placed after a typed IERC20 call is dead code for non-returning tokens; the revert happens at the call itself, so use SafeERC20 or low-level call.