15,000 USDC
View results
Submission Details
Severity: medium
Valid

[M] Contracts are vulnerable to fee-on-transfer accounting-related issues

Summary

There are ERC20 tokens that charge fee for every transfer() or transferFrom()

Vulnerability Details

The linked-in functions use transferFrom() to move funds from the sender to the recipient
but fail to verify if the received token amount matches the transferred amount.

Impact

This could pose an issue with fee-on-transfer tokens, where the post-transfer balance might be less
than anticipated, leading to balance inconsistencies.

Tools Used

Manual Review

Recommendations

A practical solution is to gauge the balance prior and post-transfer,
and consider the differential as the transferred amount, instead of the predefined amount i.e using balanceOf

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.