Submission Details
Severity:
Staking() - deposit() wont work with fee on transfer tokens
Summary
Some tokens take a transfer fee (e.g. STA, PAXG), some do not currently charge a fee but may do so in the future (e.g. USDT, USDC).
Vulnerability Details
Protocol will set user balanace with more tokens that he had transfer into, ending with a bad debt or insolvency.
Impact
Protocol insolvency, bad debt
Tools Used
Manual revision
Recommendations
If you want to make sure that there is no fee-on-transfer you could run a simple assert to ensure that evrything is as expected;
function deposit(uint _amount) external {
uint256 _before = TKN.balanceOf(address(this));
TKN.transferFrom(msg.sender, address(this), _amount);
require(_before + _amount == TKN.balanceOf(address(this)), "!fee-on-transfer");
updateFor(msg.sender);
balances[msg.sender] += _amount;
}
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
70628 USDC / LOC
18,000 USDC
2,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.