# ERC20 transferFrom return values not checked

Joyn NFT minting ignored the boolean returned by ERC20 transferFrom, so non-reverting tokens like EURS/BAT let users mint NFTs without paying the fee.

- Payout: Audit contest
- Severity: high
- Program: Joyn
- Found by: hickuphh3
- Disclosed: 2022-07-25
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-03-joyn-findings/issues/52
- Library page: https://bugbountylibrary.com/r/c4%3A2022-03-joyn%3AH-01
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:fee-bypass

**Target:** NFT minting contract's ERC20 payment path (payableToken transferFrom)
**Root cause:** The mint flow calls ERC20 transferFrom but never checks its boolean return value, so tokens that return false instead of reverting are treated as a successful payment.
**Steps:**
1. Identify the mint function that collects the mint fee via `payableToken.transferFrom(user, project, fee)`.
2. Note the return value is discarded while `transfer()` calls elsewhere are checked.
3. Choose a payableToken that returns false on failure rather than reverting (e.g. EURS, BAT).
4. Call mint with a balance/allowance that makes transferFrom return false; the call still succeeds.
5. Receive the NFT without the fee being transferred.
**How found:** Code review noticed an inconsistency: transfer() return values were checked but transferFrom() return values were not, then reasoned about ERC20 tokens that return false instead of reverting.
**Exploitation:** A minter selects a Collection whose payableToken is a non-reverting ERC20 (EURS/BAT-style), triggers mint so transferFrom returns false, and still receives the NFT for free since the return value is ignored.
**Insight:** When auditing payment paths, diff how transfer vs transferFrom return values are handled; a single unchecked transferFrom on a user-chosen token address (here payableToken set at createProject) is exploitable with legacy false-returning tokens like EURS/BAT.