Summary

The Lender.sol contract won't work correctly with fee-on transfer tokens.

Vulnerability Details

Fee-on transfer tokens can charge a certain fee in every transfer() or transferFrom() functions.

The problem is that the code does not control correctly the amount deposited to the Lender.sol contract. E.g. the addPool() function helps to the lender to add tokens to lender's pool, if the lender is using a fee-on transfer loanToken, the Lender contract will end up with less tokens than the amount value, so the update pool balance _updatePoolBalance(poolId, pools[poolId].poolBalance + amount); will not be the correct amount.

Impact

The Lender contract will end up with less token amount when users use fee-on transfer tokens.

Tools used

Manual review

Recommendations

Measure the balance before and after the transfer actions and update the correct pool balance amount. Another option is the restriction of allowed tokens in the Lender.sol contract.