First Flight #3: Thunder Loan
First Flight #3
Beginner FriendlyFoundryDeFiOracle
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

fee-on-transfer underlying break redeem function

darksnow

Summary

The current implementation doesn't work with fee-on-transfer underlying tokens. e.g. USDT is an ERC20 token that has togglable transfer fees, but for now the fee is set to 0.

Vulnerability Details

The problem arise when transferring tokens back to the last liquidity provider that want to withdraw his tokens blocking redeem function, since the contract wrongly assumes balances values.

There will always be more AssetTokens than its underlying value.

Example with FOT token fee 10%:

  • Bob deposit 1000 FOT tokens.

  • AssetTokens contract receives 900 tokens but mint 1000 AssetTokens reedimable for 1000 FOT tokens.

  • Bob tries to reedem his tokens sending his 1000 AssetTokens but the transfer reverts.

  • Bob then tries to reedem with 900 AssetTokens and receive 810 FOT tokens.

  • Alice deposits 1000 FOT tokens.

  • Bob reedems 90 FOT tokens with his remaining 100 AssetTokens stealing Alice's funds.

Impact

Last liquidity providers to withdraw will not be able to redeem their tokens.

Tools Used

Manual review

Recommendations

Add logic to calculate exactly how many tokens were actually sent to the contract.

function deposit(
IERC20 token,
uint256 amount
) external revertIfZero(amount) revertIfNotAllowedToken(token) {
AssetToken assetToken = s_tokenToAssetToken[token];
​
uint256 balanceBefore = token.balanceOf(address(this));
token.safeTransferFrom(msg.sender, address(assetToken), amount);
uint256 balanceAfter = token.balanceOf(address(this));
uint256 amountTransferred = balanceAfter - balanceBefore;
​
uint256 exchangeRate = assetToken.getExchangeRate();
uint256 mintAmount = (amountTransferred * assetToken.EXCHANGE_RATE_PRECISION()) /
exchangeRate;
emit Deposit(msg.sender, token, amountTransferred);
assetToken.mint(msg.sender, mintAmount);
}
Updates

Lead Judging Commences

0xnevi Lead Judge about 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

fee on transfer

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.