Beedle - Oracle free perpetual lending

Summary

Using Lender on fee-on-transfer tokens will cause accounting issues.

Vulnerability Details

There are deflationary ERC20 tokens that burns a small fee on each transferring. The Lender contract uses transferFrom to pull users' tokens to itself. However, it immediately uses the amount parameter input as a source of truth for the amount received. If the ERC20 token is deflationary, then the actual amount it received will be less than expected, causing accounting issues.

Impact

The contract will have received less tokens than it thinks, causing incorrect accounting for borrows.

Tools Used

Manual review

Recommendations

Wrap each token pulls around an internal function, returning the actual amount received for accounting, instead of using the amount that we expect.