The Standard

Summary

The protocol does not have any check for fee-on-transfer tokens if they are used for liquidity or rewards as they will be received or rewarded less than the actual amount.

Vulnerability Details

Throughout codebase in-scope ERC20 tokens are transferred using either transfer/safeTransfer method which can result in received amount less than the input amount for token that charges fee on transfer.

Impact

Loss of amount in terms of reward/fee or liquidation amount for protocol as the amount transferred is not check for actually received or sent amount.

Tools Used

Manual Code Review / Solodit

Recommendations

The transfer utility functions can be updated to return the actually received amount or clearly document that only standard ERC20 tokens are supported.