Submission Details
Severity:
Accounting won't work with Fees on transfer tokens
Summary
When token is fee-on transfer token, the fees deducted is not accounted the contract.
Vulnerability Details
Some tokens take a transfer fee (e.g. STA, PAXG), some do not currently charge a fee but may do so in the future (e.g. USDT, USDC).
File: DSCEngine.sol
Deposit:
155: s_collateralDeposited[msg.sender][tokenCollateralAddress] += amountCollateral;
Redeem:
285: s_collateralDeposited[from][tokenCollateralAddress] -= amountCollateral;
Those fees deducted are not accounted properly which lead to accounting issues where User can redeem more than what he/she deposit making contract Insolvent.
Impact
Protocol insolvency due wrong accounting.
Tools Used
Manual Review
Recommendations
Check the asset change right before and after the asset-transferring and update the state variables accordingly.
Prize pool breakdown
Total prize
15,000 USDC
nSLOC
23664 USDC / LOC
14,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.