Submission Details
Severity:
Fee on transfer collaterals
Summary
There are tokens which charge fees when moving them and of they are used as collaterals, the protocol won't work properly
Vulnerability Details
For instance in DSCEngine.sol
function depositCollateral(address tokenCollateralAddress, uint256 amountCollateral)
public
moreThanZero(amountCollateral)
isAllowedToken(tokenCollateralAddress)
nonReentrant
{
s_collateralDeposited[msg.sender][tokenCollateralAddress] += amountCollateral;
emit CollateralDeposited(msg.sender, tokenCollateralAddress, amountCollateral);
bool success = IERC20(tokenCollateralAddress).transferFrom(msg.sender, address(this), amountCollateral);
if (!success) {
revert DSCEngine__TransferFailed();
}
}
The following line will lead to the protocol receiving less tokens than expected
bool success = IERC20(tokenCollateralAddress).transferFrom(msg.sender, address(this), amountCollateral);
Impact
The protocol will have accounting errors
Tools Used
Manual review
Recommendations
Consider choosing collateral tokens that do not support transfer fees or get the actual received amount by calculating the difference of token balance before and after the transfer.
Prize pool breakdown
Total prize
15,000 USDC
nSLOC
23664 USDC / LOC
14,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.