Sparkn

CodeFox Inc.
DeFiFoundryProxy
15,000 USDC
View results
Previous Next
Submission Details
Severity: medium

If a token is used that takes a transfer fee then `STADIUM_ADDRESS` will receive less funds than expected

tsvetanovv

Summary

If a token is used that takes a transfer fee then STADIUM_ADDRESS will receive less funds than expected

Vulnerability Details

Some ERC20 token implementations have a fee that is charged on each token transfer. This means that the transferred amount isn't exactly what the receiver will get.
When sending prizes to winners via the _distribute function if such a token is used then in the end STADIUM_ADDRESS will receive less funds than expected.

for (uint256 i; i < winnersLength;) {
uint256 amount = totalAmount * percentages[i] / BASIS_POINTS;
erc20.safeTransfer(winners[i], amount);
unchecked {
++i;
}
}
​
// send commission fee as well as all the remaining tokens to STADIUM_ADDRESS to avoid dust remaining
_commissionTransfer(erc20);
emit Distributed(token, winners, percentages, data);

Impact

STADIUM_ADDRESS will receive fewer funds than expected

Tools Used

Visual Studio Code

Recommendations

Improve support for a fee on transfer type of ERC20. When transferring funds the usual approach is to compare balances pre/post transfer.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.