Summary

The project is incompatible with fee on transfer tokens. If they are used, some users may be unable to redeem their collateral

Vulnerability Details

Some ERC20 tokens may have fees attached to the transfer, while others could enable them in the future (e.g., USDT, USDC). The current implementation of DSCEngine.sol is not taking these types of ERC20 tokens into consideration. DSCEngine.sol assumes that the amount specified by the user will be the exact amount transferred to the contract's balance, whereas, in reality, the contract will receive less.

For instance, in the depositCollateral function, the actual amount of collateral transferred to the contract is less than what is recorded in s_collateralDeposited

So, in _redeemCollateral, users can redeem more tokens, leaving the contract insolvent

Impact

Last users may be unable to redeem their collateral because contract may not have enough funds.

I believe a medium severity classification is appropriate because if popular tokens like USDT or USDC (which are likely to be used as collateral) enable fees, it could disrupt the accounting of deposited tokens. Additionally, there might be other tokens that charge fees on transfer, and they could also be used as collateral.

Tools Used

Manual review

Recommendations

Consider updating the DSCEngine logic to track the real amount of token that has been sent by the user after the transfer (difference in before and after balance)