Summary

Rebasing tokens are tokens that have each holder's balanceof() increase over time. Aave aTokens are an example of such tokens.

Vulnerability Details

Users expect that when they deposit tokens to a pool, that they get back all rewards earned, not just a flat rate. With the contracts of this project, deposited tokens will grow in value, but the value in excess of the pre-calculated s_collateralDeposited[msg.sender][tokenCollateralAddress] += amountCollateral; amounts go solely to the owner/creator, or will remain locked in the contract

Impact

If rebasing tokens are used as the collateral token, rewards accrue to the contract and cannot be withdrawn by either the user or the owner, and remain locked forever.

Tools Used

Manual Review

Recommendations

Provide a function for the pool owner to withdraw excess deposited tokens and repay any associated taxes. Or create a blocklist for rebasing tokens.