Summary

Contract doesn't support rebasing tokens

Vulnerability Details

DSCEngine is going to support any erc20 token, however it's not like that. In case if rebasing token will be used, then accounting in the contract will be broken.

Rebasing tokens change balance of user periodically, so in case if user provided 1000 rebasing tokens at timestamp 0 to the DSCEngine, then at timestamp 10 it can be 1001 token already. But DSCEngine can't track this and as result these additional accumulated tokens will not be accounted in the health factor calculation and they will not be returned, when user removes collateral.

Impact

Contract can't handle such tokens

Tools Used

VsCode

Recommendations

Some tokens should be blacklisted.