Beedle - Oracle free perpetual lending

Summary

In case ERC20 token is fee-on-transfer, stake can loss funds when users withdraw

Vulnerability Details

The result is when a user withdraws his funds from Vault, Vault can be lost and it may make unable for later users to withdraw their funds.

Impact

Transfer fee tokens work by deducting a percentage of the transaction amount as a fee. However, the Repository logic does not handle such tokens correctly, leading to loss of funds and incorrect protocol functionality.

For example, consider a Pool with a transfer fee of ERC20 as a credit token (5% fee). Alice deposits 1000 coins into the pool so Alice gets N to be added to her shares balance. However, due to safeTransferFrom() fees, only 950 coins will be transferred to the pool. As we can see, there is a mismatch between the actual value of alice received shares and the amount received by the pool.

Tools Used

Manuel Code Review

Recommendations

Consider checking the token buyer balance before and after the transfer