check return value of transfer()/transferFrom()

README.md

@@ -113,7 +113,7 @@ no-bidi-characters | Generic | The code must not contain any of Unicode Directio
 delegatecall-to-arbitrary-address | Generic | An attacker may perform delegatecall() to an arbitrary address.
 incorrect-use-of-blockhash | Generic | blockhash(block.number) and blockhash(block.number + N) always returns 0.
 accessible-selfdestruct | Generic | Contract can be destructed by anyone in $FUNC
-
+transfer-return-value-not-checked | Generic | The return value of transfer/transferFrom functions should be checked
 ## Gas Optimization Rules
 
 Rule ID | Description

solidity/security/transfer-return-value-not-checked.sol

@@ -0,0 +1,37 @@
+pragma solidity >=0.7.4;
+
+contract Test{
+    function payment() public {
+        //ok: transfer-return-value-not-checked
+        bool kek = IERC20(token0).transfer(msg.sender, refund);
+    }
+
+    function payment2() public {
+        //ok: transfer-return-value-not-checked
+        require(IERC20(token0).transfer(msg.sender, refund), "error");
+    }
+
+    function payment3() public {
+        //ruleid: transfer-return-value-not-checked
+        IERC20(token0).transfer(msg.sender, refund);
+    }
+
+
+    function payment4() public {
+        //ok: transfer-return-value-not-checked
+        if(IERC20(token0).transfer(msg.sender, refund)) {
+            //proccess
+        } else {
+            revert("error");
+        }
+    }
+}
+
+
+contract Test2 {
+    IWETH9 weth = address(0);
+    function sendWETHT(address to, uint256 amount) private {
+        //ok: transfer-return-value-not-checked
+        IWETH9(weth).transfer(to, amount);
+    }
+}

solidity/security/transfer-return-value-not-checked.yaml

@@ -0,0 +1,24 @@
+rules:
+  - id: transfer-return-value-not-checked
+    metadata:
+      references:
+        - https://code4rena.com/reports/2022-03-joyn#h-01-erc20-transferfrom-return-values-not-checked
+      category: security
+      tags:
+        - transfer
+        - transferFrom
+    message: The missing return value check of the ERC20 transfer can result in loss of funds, because some ERC20 tokens indicate a failed transfer by the return value instead of a revert.
+    languages:
+      - solidity
+    severity: WARNING
+    patterns: 
+      - pattern-either:
+          - pattern: $VAR.transfer($TO, $AMOUNT);
+          - pattern: $VAR.transferFrom($FROM, $TO, $AMOUNT);
+      - pattern-not: $RETURN = $VAR.transfer(...);
+      - pattern-not: $RETURN = $VAR.transferFrom(...);
+      - pattern-not-inside: if(...);
+      - pattern-not-inside: require(...); 
+      - pattern-not-inside: assert(...); 
+      - pattern-not-inside: IWETH9(...); 
+      - pattern-not-inside: IWETH(...);