Beedle - Oracle free perpetual lending
BeedleFi
DeFiFoundry
20,000 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Pool owners can lose tokens with fee-on-transfer tokens

0xswahili

Summary

Lender.sol accounting for fee-on-transfer token can be incorrect since pools[poolId].poolBalance storage variable will be out-of-sync with contract token balance.

Vulnerability Details

The actual amount transferred when using fee-on-transfer tokens is less than user deposited amount. This will result in wrong accounting between pools[poolId].poolBalance storage variable and contract token balance.

Impact

Pool owner looses tokens that cannot be accounted for.

Tools Used

Manual review

Recommendations

In order to prevent pool owners from using fee-on-transfer tokens, confirm Lender.sol token balance before and after depositing.

Add at Ln 186

​
uint256 balanceBefore = IERC20(pools[poolId].loanToken).balanceOf(address(this));
​

and at [Ln 192](Add at Ln 186)

​
uint256 balanceAfter = IERC20(pools[poolId].loanToken).balanceOf(address(this));
require(balanceBefore + amount == balanceAfter,"Fee-on-transfer tokens not allowed");

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.