Beedle - Oracle free perpetual lending
BeedleFi
DeFiFoundry
20,000 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Collateral accounting is broken for fee-on-transfer tokens such as USDT

toshii

Summary

The logic for accounting for deposits is broken for fee-on-transfer tokens, resulting in lenders getting credited for having a larger poolBalance then they actually do.

Vulnerability Details

The addToPool function, which allows lenders to add more tokens to their pool is defined as follows:

function addToPool(bytes32 poolId, uint256 amount) external {
if (pools[poolId].lender != msg.sender) revert Unauthorized();
if (amount == 0) revert PoolConfig();
_updatePoolBalance(poolId, pools[poolId].poolBalance + amount);
// transfer the loan tokens from the lender to the contract
IERC20(pools[poolId].loanToken).transferFrom(
msg.sender,
address(this),
amount
);
}

The lender's pool balance is credited by amount, while the actual amount transferred in will be less than this, as it doesn't account for the fee taken on the transfer.

Impact

Lack of correct accounting of fee-on-transfer tokens results in lender's getting credited with an excess amount of poolBalance.

Tools Used

Manual review

Recommendations

When transferring in tokens from a lender, the difference between the balance before and after the transfer should be credited to the lender's pool.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.