Submission Details
Severity:
if the token is not conforming to erc20 standard then there are issues
Summary
non conforming erc20 standards have many issues with this protocol
Vulnerability Details
if a token is a fee on a transfer then when transferring tokens the update will be more than we transferred (will other lenders’ debt be used instead of ours) and it will remove more than it transferred. There might be no fee since it will take the fee for itself.
On the collateral side, it will do the same.
pools[poolId].outstandingLoans += debt;
// calculate the fees
uint256 fees = (debt * borrowerFee) / 10000;
// transfer fees
IERC20(loan.loanToken).transfer(feeReceiver, fees);
// transfer the loan tokens from the pool to the borrower
IERC20(loan.loanToken).transfer(msg.sender, debt - fees);
// transfer the collateral tokens from the borrower to the contract
IERC20(loan.collateralToken).transferFrom(
msg.sender,
address(this),
collateral
);
Impact
as shown above issues with fee on transfer tokens
(weird tokens)[https://github.com/d-xo/weird-erc20]
Tools Used
Recommendations
have token allow list or some comments about it on the frontend
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
70628 USDC / LOC
18,000 USDC
2,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.