fix: Check token address is a contract (SC-4179)

src/ERC20Helper.sol

@@ -4,7 +4,7 @@ pragma solidity ^0.8.7;
 import { IERC20 } from "../lib/erc20/src/interfaces/IERC20.sol";
 
 /**
- * @title Small Library to standardize erc20 token interactions. 
+ * @title Small Library to standardize erc20 token interactions.
  * @dev   Code taken from https://github.com/maple-labs/erc20-helper
  * @dev   Acknowledgements to Solmate, OpenZeppelin, and Uniswap-V3 for inspiring this code.
  */
@@ -27,6 +27,14 @@ library ERC20Helper {
     }
 
     function _call(address token, bytes memory data) private returns (bool success) {
+        uint256 size;
+
+        assembly {
+            size := extcodesize(token)
+        }
+
+        if (size == uint256(0)) return false;
+
         bytes memory returnData;
         (success, returnData) = token.call(data);
 

src/test/ERC20Helper.t.sol

@@ -8,7 +8,7 @@ import { ERC20Helper } from "../ERC20Helper.sol";
 import { ERC20TrueReturner, ERC20FalseReturner, ERC20NoReturner, ERC20Reverter } from "./mocks/ERC20Mocks.sol";
 
 contract ERC20HelperTest is DSTest {
-    
+
     ERC20FalseReturner falseReturner;
     ERC20TrueReturner  trueReturner;
     ERC20NoReturner    noReturner;
@@ -53,6 +53,10 @@ contract ERC20HelperTest is DSTest {
         require(ERC20Helper.transfer(address(reverter), to, amount));
     }
 
+    function proveFail_transfer_notContract(address to, uint256 amount) public {
+        require(ERC20Helper.transfer(address(1), to, amount));
+    }
+
     function proveFail_transferFrom_falseReturner(address from, address to, uint256 amount) public {
         require(ERC20Helper.transferFrom(address(falseReturner), from, to, amount));
     }
@@ -61,6 +65,10 @@ contract ERC20HelperTest is DSTest {
         require(ERC20Helper.transferFrom(address(reverter), from, to, amount));
     }
 
+    function proveFail_transferFrom_notContract(address from, address to, uint256 amount) public {
+        require(ERC20Helper.transferFrom(address(1), from, to, amount));
+    }
+
     function proveFail_approve_falseReturner(address to, uint256 amount) public {
         require(ERC20Helper.approve(address(falseReturner), to, amount));
     }
@@ -69,4 +77,8 @@ contract ERC20HelperTest is DSTest {
         require(ERC20Helper.approve(address(reverter), to, amount));
     }
 
+    function proveFail_approve_notContract(address to, uint256 amount) public {
+        require(ERC20Helper.approve(address(1), to, amount));
+    }
+
 }

src/test/mocks/ERC20Mocks.sol

@@ -10,7 +10,7 @@ contract ERC20TrueReturner {
     function transferFrom(address from, address to, uint256 value) external pure returns (bool) {
         return true;
     }
-    
+
     function approve(address to, uint256 value) external pure returns (bool) {
         return true;
     }
@@ -26,7 +26,7 @@ contract ERC20FalseReturner {
     function transferFrom(address from, address to, uint256 value) external pure returns (bool) {
         return false;
     }
-    
+
     function approve(address to, uint256 value) external pure returns (bool) {
         return false;
     }
@@ -38,7 +38,7 @@ contract ERC20NoReturner {
     function transfer(address to, uint256 value) external {}
 
     function transferFrom(address from, address to, uint256 value) external {}
-    
+
     function approve(address to, uint256 value) external {}
 
 }
@@ -52,7 +52,7 @@ contract ERC20Reverter {
     function transferFrom(address from, address to, uint256 value) external pure returns (bool) {
         require(false);
     }
-    
+
     function approve(address to, uint256 value) external pure returns (bool) {
         require(false);
     }

src/test/utils/InvariantTest.sol

@@ -2,7 +2,7 @@
 pragma solidity ^0.8.7;
 
 contract InvariantTest {
-    
+
     address[] private targetContracts_;
 
     function targetContracts() public view returns (address[] memory) {

test.sh

@@ -24,6 +24,6 @@ if [ "$skip_build" = "1" ]; then export DAPP_SKIP_BUILD=1; fi
 
 if [ -z "$test" ]; then match="[src/test/*.t.sol]"; dapp_test_verbosity=1; else match=$test; dapp_test_verbosity=2; fi
 
-echo LANG=C.UTF-8 dapp test --match "$match" --rpc-url "$ETH_RPC_URL" --verbosity $dapp_test_verbosity --fuzz-runs $runs
+echo LANG=C.UTF-8 dapp test --match "$match" --verbosity $dapp_test_verbosity --fuzz-runs $runs
 
-LANG=C.UTF-8 dapp test --match "$match" --rpc-url "$ETH_RPC_URL" --verbosity $dapp_test_verbosity --fuzz-runs $runs; 
+LANG=C.UTF-8 dapp test --match "$match" --verbosity $dapp_test_verbosity --fuzz-runs $runs;