15,000 USDC
View results
Submission Details
Severity: medium
Valid

The protocol doesn't have support for fee on transfer type of ERC20 tokens

Summary

From the discord server, we see:

Q: so should we audit considering all ERC20?
A: Let's do any token that has a chainlink price feed.

But he protocol doesn't have support for fee on transfer type of ERC20 tokens

Vulnerability Details

In the following places in DSCEngine.sol we see this problem:

157: bool success = IERC20(tokenCollateralAddress).transferFrom(msg.sender, address(this), amountCollateral);
274: bool success = i_dsc.transferFrom(dscFrom, address(this), amountDscToBurn);
287: bool success = IERC20(tokenCollateralAddress).transfer(to, amountCollateral);

Impact

Some ERC20 token implementations have a fee that is charged on each token transfer. This means that the transferred amount isn't exactly what the receiver will get.

Tools Used

Visual Studio Code

Recommendations

Improve support for a fee on transfer type of ERC20. When pulling funds from the user using transferFrom() and transfer() the usual approach is to compare balances pre/post transfer.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.