F-2024-0012·spec-deviation

Unutilized memo field in fungible token transfer methods

Acknowledgedbridgenearrainbow-bridgegithub.com/Near-One/rainbow-token-connector
TL;DR

ft_transfer and ft_transfer_call accept a memo parameter described as optional metadata, but the field is not used inside the implementations.

Severity
INFO
Impact
LOW
Likelihood
LOW
Method
MManual review
CAT.
Complexity
LOW
Exploitability
LOW
02Section · Description

Description

The provided code snippet includes two methods for transferring fungible tokens: ft_transfer and ft_transfer_call. Both methods take a memo parameter, which is described as optional and intended for use cases that may benefit from indexing or providing additional information for a transfer. However, upon further inspection, it appears that the memo field is not actually utilized within the implementation of these methods.

rust
#[private]
#[payable]
pub fn finish_withdraw(
&mut self,
#[callback]
#[serializer(borsh)]
verification_success: bool,
#[serializer(borsh)] token: AccountId,
#[serializer(borsh)] recipient: Recipient,
#[serializer(borsh)] amount: Balance,
#[serializer(borsh)] proof_key: Vec<u8>,
) -> Promise {
assert!(verification_success, "Failed to verify the proof");
let required_deposit = self.record_proof(&proof_key);
assert!(env::attached_deposit() >= required_deposit);
let Recipient { target, message } = recipient;
match message {
Some(message) => ext_token::ext(token)
.with_attached_deposit(near_sdk::ONE_YOCTO)
.with_static_gas(FT_TRANSFER_CALL_GAS)
.ft_transfer_call(target, amount.into(), None, message),
None => ext_token::ext(token)
.with_attached_deposit(near_sdk::ONE_YOCTO)
.with_static_gas(FT_TRANSFER_GAS)
.ft_transfer(target, amount.into(), None),
}
}
03Section · Impact

Impact

The memo field is intended to provide additional context or information for transfers, but since it is not being utilized, this functionality is effectively unused. This can lead to missed opportunities for capturing relevant metadata or implementing features that rely on the memo field.

04Section · Recommendation

Recommendation

Determine the specific use cases or scenarios where the memo field can provide value and incorporate the necessary logic to handle and process the memo information accordingly.

05Section · Resolution

Resolution

Unresolved.

F-2024-0012

oog
zealynx

Smart Contract Security Digest

Monthly exploit breakdowns, audit checklists, and DeFi security research — straight to your inbox

© 2026 Zealynx