Foundry DeFi Stablecoin CodeHawks Audit Contest

Summary

Vulnerability Details

Some ERC20 tokens make modifications to the standard implementations of
their ERC20’s transfer or balanceOf functions.
One type of such token is deflationary tokens that charge a fee on every
transfer() and transferFrom().
The protocol does not have incompatibility with fee-on-transfer tokens.

Note that there has been a real-world exploit related to this with
Balancer pool and STA deflationary tokens.

There are 3 instances of this issue:

• success = IERC20(tokenCollateralAddress).transferFrom(msg.sender,address(this),amountCollateral) with fee on transfer are not supported.

• success = i_dsc.transferFrom(dscFrom,address(this),amountDscToBurn) with fee on transfer are not supported.

• success = IERC20(tokenCollateralAddress).transfer(to,amountCollateral) with fee on transfer are not supported.

Exploit scenario

i.e. Fee-on-transfer scenario:

1. Contract calls transfer from contractA 100 tokens to current contract

2. Current contract thinks it received 100 tokens

3. It updates balances to increase +100 tokens

4. While actually contract received only 90 tokens

5. That breaks whole math for given token

Impact

Tools Used

Recommendations

1. Consider comparing before and after balance to get the actual transferred amount.

2. Alternatively, disallow tokens with fee-on-transfer mechanics to be added as tokens.