fix: ERC20 return data size (DEV-1147)

[deluca-mike]

Summary by CodeRabbit

• Bug Fixes
  • Enhanced validation of return data from external contract calls to strictly enforce proper encoding of boolean responses, ensuring only 32-byte boolean values or empty returns are accepted as valid success indicators across asset transfer and approval operations.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[notion-workspace]

Verify returnData is 32 bytes in all safe approves

[octane-security-app]

Summary by Octane

New Contracts

No new contracts were added.

Updated Contracts

• ForeignController.sol: Added checks for 32-byte length in return data for transfer and approve operations to enhance contract validation.
• MainnetController.sol: Key modification ensures data returned from transfers must be 32 bytes long and decode to true.
• ApproveLib.sol: Enhanced smart contract to validate return data length for approval, ensuring 32-byte boolean return for successful execution.
• UniswapV4Lib.sol: Added a length check for the approve result to ensure 32-byte responses are correctly decoded and validated.

---

🔗 Commit Hash: 2b71d48

[coderabbitai]

Walkthrough

The PR tightens ERC20 call return-data validation across multiple contract files. All modified locations now require non-empty return data to be exactly 32 bytes and decode to true, while still accepting empty return data. This affects transfer, transferFrom, and approve operations in controllers and libraries.

Changes

Cohort / File(s)	Summary
Controller Return-Data Validation src/ForeignController.sol, src/MainnetController.sol	Enforces 32-byte length requirement for non-empty boolean return data in transfer and approve operations. Non-empty returnData must be exactly 32 bytes and decode to true, while empty returns remain acceptable.
Library Approval Handling src/libraries/ApproveLib.sol, src/libraries/UniswapV4Lib.sol	Tightens ERC20 approve call return-data interpretation by requiring non-empty results to be exactly 32 bytes and decode to true. Eliminates acceptance of non-standard return encodings.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• fix: transfer in transferAsset, otcSend and otcClaim to revert on silent failures #170: Modifies the same ERC20 call-result handling in transfer/approve flows to change how empty vs. boolean returnData is interpreted across transferAsset and approve paths.
• fix: Add an explicit bounds check to prevent silent truncation in _approveWithPermit2  #207: Modifies _approveWithPermit2 in UniswapV4Lib with similar return-data validation tightening and bounds checking on amounts.

Suggested labels

Priority: High

Suggested reviewers

• lucas-manuel

Poem

🐰 A rabbit hops through boolean dreams,
Where return data flows in careful streams,
Thirty-two bytes—no more, no less!
True validation brings finesse,
No fuzzy logic leads astray, hooray!

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'fix: ERC20 return data size (DEV-1147)' follows the required format of starting with a word and colon, includes the JIRA key, and accurately describes the main change: tightening ERC20 return data validation across multiple files.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch fix/dev-1147-erc20-return-data-size

Warning

Review ran into problems

🔥 Problems

Errors were encountered while retrieving linked issues.

Errors (1)

• DEV-1147: Entity not found: Issue - Could not find referenced Issue.

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

Coverage after merging fix/dev-1147-erc20-return-data-size into dev will be

99.40%

Coverage Report

File	Stmts	Branches	Funcs	Lines	Uncovered Lines
deploy
ControllerDeploy.sol	100%	100%	100%	100%
ForeignControllerInit.sol	100%	100%	100%	100%
MainnetControllerInit.sol	97.37%	93.33%	100%	100%	152, 90
src
ALMProxy.sol	100%	100%	100%	100%
ALMProxyFreezable.sol	100%	100%	100%	100%
ForeignController.sol	96.10%	89.66%	95.65%	98.04%	130–131, 131, 131, 556
MainnetController.sol	99.18%	100%	98.36%	99.24%	596–597
OTCBuffer.sol	92.31%	100%	83.33%	93.75%	55
RateLimitHelpers.sol	100%	100%	100%	100%
RateLimits.sol	100%	100%	100%	100%
WEETHModule.sol	92.86%	75%	100%	100%	29, 41
src/libraries
AaveLib.sol	100%	100%	100%	100%
ApproveLib.sol	100%	100%	100%	100%
CCTPLib.sol	100%	100%	100%	100%
CurveLib.sol	100%	100%	100%	100%
ERC4626Lib.sol	97.06%	90%	100%	100%	117
LayerZeroLib.sol	100%	100%	100%	100%
PSMLib.sol	100%	100%	100%	100%
UniswapV4Lib.sol	99.32%	95.65%	100%	100%	282
WEETHLib.sol	100%	100%	100%	100%

[octane-security-app]

Overview

Warnings found:	1

---

🔗 Commit Hash: 2b71d48
🛡️ Octane Dashboard: All vulnerabilities