Beedle - Oracle free perpetual lending
BeedleFi
DeFiFoundry
20,000 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Can manipulate protocol poolBalance via Reflection Tokens

alra

Summary

Widely used tokens as Safemoon and Shiba Inu have reflection token mechanics, in which a percentage of the transaction gets reflected to other addresses. Because this protocol doesn't check for balanceOf() after the transfer, this can lead to a false poolBalance value, which disrupts the pool soundness.

Vulnerability Details

File: src/Lender.sol
​
152: IERC20(p.loanToken).transferFrom(
159: IERC20(p.loanToken).transfer(
187: IERC20(pools[poolId].loanToken).transferFrom(
203: IERC20(pools[poolId].loanToken).transfer(msg.sender, amount);
267: IERC20(loan.loanToken).transfer(feeReceiver, fees);
269: IERC20(loan.loanToken).transfer(msg.sender, debt - fees);
271: IERC20(loan.collateralToken).transferFrom(
317: IERC20(loan.loanToken).transferFrom(
323: IERC20(loan.loanToken).transferFrom(
329: IERC20(loan.collateralToken).transfer(
403: IERC20(loan.loanToken).transfer(feeReceiver, protocolInterest);
505: IERC20(loan.loanToken).transfer(feeReceiver, protocolInterest);
563: IERC20(loan.collateralToken).transfer(feeReceiver, govFee);
565: IERC20(loan.collateralToken).transfer(
642: IERC20(loan.loanToken).transferFrom(
651: IERC20(loan.loanToken).transfer(feeReceiver, fee);
653: IERC20(loan.loanToken).transfer(msg.sender, debt - debtToPay - fee);
656: IERC20(loan.loanToken).transfer(feeReceiver, protocolInterest);
663: IERC20(loan.collateralToken).transferFrom(
670: IERC20(loan.collateralToken).transfer(

Impact

Popular and widely used tokens with reflection mechanics on _transfer can lead to incorrect poolBalance state variable updates, corrupting all the other state variables which depend on this one.

Tools Used

Manual review.

Recommendations

Check the balanceOf() of the token after the transfer is done.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.