Beedle - Oracle free perpetual lending
BeedleFi
DeFiFoundry
20,000 USDC
View results
Previous Next
Submission Details
Severity: medium

Reflection tokens can lead to incorrect contract state

alex

Summary

Widely used tokens as shiba have reflection token mechanics, that means that in the transfer function part of the tokens are transferred to a different address than the receiver (in that case Lender.sol). That leads to an incorrect state for the pool balance and can produce unexpected behavior.

Vulnerability Details

File: src/Lender.sol

152: IERC20(p.loanToken).transferFrom(
159: IERC20(p.loanToken).transfer(
187: IERC20(pools[poolId].loanToken).transferFrom(
203: IERC20(pools[poolId].loanToken).transfer(msg.sender, amount);
267: IERC20(loan.loanToken).transfer(feeReceiver, fees);
269: IERC20(loan.loanToken).transfer(msg.sender, debt - fees);
271: IERC20(loan.collateralToken).transferFrom(
317: IERC20(loan.loanToken).transferFrom(
323: IERC20(loan.loanToken).transferFrom(
329: IERC20(loan.collateralToken).transfer(
403: IERC20(loan.loanToken).transfer(feeReceiver, protocolInterest);
505: IERC20(loan.loanToken).transfer(feeReceiver, protocolInterest);
563: IERC20(loan.collateralToken).transfer(feeReceiver, govFee);
565: IERC20(loan.collateralToken).transfer(
642: IERC20(loan.loanToken).transferFrom(
651: IERC20(loan.loanToken).transfer(feeReceiver, fee);
653: IERC20(loan.loanToken).transfer(msg.sender, debt - debtToPay - fee);
656: IERC20(loan.loanToken).transfer(feeReceiver, protocolInterest);
663: IERC20(loan.collateralToken).transferFrom(
670: IERC20(loan.collateralToken).transfer(

Impact

Popular and widely used tokens with reflection mechanics on _transfer can lead to incorrect poolBalance state variable updates, corrupting all the other state variables which depend on this one.

Tools Used

Manual Review

Recommendations

Check the balanceOf() of the token after the transfer is done.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!