Beedle - Oracle free perpetual lending

Summary

Some tokens take a transfer fee (e.g. STA, PAXG), some do not currently charge a fee but may do so in the future (e.g. USDT, USDC).

Vulnerability Details

The problem arises when every transfer or transferFrom of underlying tokens basically blocking all functions in for the token, since the contract wrongly assumes balances values.
This becomes particularly problematic in the following scenario: a market for USDT is running without problems, then they activate the fee.

Impact

Fee on transfer can result in always receiving and transferring less funds than intended causing loss to both project and user.

Tools Used

Manual code Review

Recommendations

If the protocol wants to use all possible tokens, a way to handle these tokens must be implemented. A possible way to do it is to check the balance of the contract before and after every time a token is transferred to see the effective quantity.