The Standard

Summary

In the codebase, the use of transfer, safeTransfer and safeTransferFrom assumes that the receiver receives the exact transferred amount.

Vulnerability Details

This is an issue because PAXG, one of the protocol's base token charges a fee upon transfer.
For instance -
In the forwardRemainingRewards function, If the balance is small enough, the protocol might not receive any tokens, or the fee charged might be more than the balance causing a reversion.

In the removeCollateral function, the extra fee deducted on transfer(some tokens deduct directly from sender balance, not from transfer amt) during collateral removal can cause the position to actually become undercollaterized, even though, the canRemoveCollateral doesn't show this, putting the user's position at risk of liquidation.

It also affects swaps, rewards claimed and so on.

Impact

The recipient address may not receive the full transfered amount, which can break the protocol's accounting and revert transactions.

Tools Used

Manual code review

Recommendations

Consider introducing a balance calculations before and after transfer to get the actual transfer amount.