Summary

Fee on transfer tokens are not correctly accounted for.

Vulnerability Details

Due to fee on transfer tokens taking a fee, if accepted by the protocol whenever a user deposits collateral the amountCollateral variable will not match the actual amount of tokens received. This will result in mismatches in accounting and can result in users being unable to withdraw their tokens.

Impact

If the protocol is only ever intended to be deployed with WBTC and WETH this will not be an issue, but it should be considered if intending to deploy with other tokens as if FoT tokens are added then it can result in discrepancies between the accounting values in the protocol and actual token balances.

Tools Used

Manual Review

Recommendations

Either check balance before/after transferring tokens into the protocol or restrict FoT tokens from ever being added.