Sparkn

CodeFox Inc.
DeFiFoundryProxy
15,000 USDC
View results
Previous Next
Submission Details
Severity: high

_distribute function is not fully compatible with fee on transfer tokens

arnie

Summary

The _distribute function does not correctly account for/ is not compatible with fee on transfer tokens.

Vulnerability Details

In the distribute function, there is a for loop that goes through an array and distributes tokens based on the percentage of the pot they are allocated.

for (uint256 i; i < winnersLength;) {
uint256 amount = totalAmount * percentages[i] / BASIS_POINTS;
erc20.safeTransfer(winners[i], amount);
unchecked {
++i;

The problem here is that when transferring tokens to the winners, if the token given out has a fee on transfer, not all winners will receive their payout or their payout will be lower than it should. Such tokens that have a fee on transfer are STA and PAXG. Additionally USDC and USDT are subject to potential fees on transfer in the future.

Impact

Loss of funds when using fee on transfer tokens

Tools Used

manual review

Recommendations

add logic to support fee on transfer

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.