Sparkn

Summary

Contracts are vulnerable due to token being fee-on-transfer and would cause accounting-related issues

Vulnerability Details

The functions transfer funds from the caller to the receiver address via transferFrom(), but do not ensure that the actual number of tokens received is the same as the input amount to the transfer.

Impact

If the token is a fee-on-transfer token, the balance after the transfer will be smaller than expected, leading to accounting issues. Even if there are checks later, related to a secondary transfer, an attacker may be able to use latent funds (e.g. mistakenly sent by another user) in order to get a free credit.

Tools Used

Manual code Analysis

Recommendations

One way to solve this problem is to measure the balance before and after the transfer, and use the difference as the amount, rather than the stated amount.