The Standard
The Standard
DeFiHardhat
20,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Fee-on-transfer tokens may break the logic of the protocol.

DarkTower

Summary

Fee on transfer token assets can lead to discrepancies between the token balance in the contract LiquidityPool and the internal accounting of user rewards, potentially resulting in some users being unable to claim their rewards.

Vulnerability Details

The problem lies in the function LiquidityPool::distributeAssets. When distributing assets, a portion of the tokens is added to the holders' balance and then transferred from the manager to the LiquidityPool contract.

However, for tokens that impose a fee on transfer, the actual amount received by the contract will be less than the amount sent.

Over time, this discrepancy accumulates, leading to a situation where the contract's actual token balance is less than the total sum of recorded rewards.

Impact

The actual balance of the token in the contract might be lower than the recorded total rewards
Some users may not be able to claim their rewards if the actual token balance is lower than the internally tracked amount
Locked funds

Recommandation

Adjust the code after line 225 as such :

+ if (asset.token.addr == address(0)) {
+ nativePurchased += _portion;
+ } else {
+ uint256 beforeBalance = IERC20(asset.token.addr).balanceOf(this);
+ IERC20(asset.token.addr).safeTransferFrom(manager, address(this), + _portion);
+ _portion = IERC20(asset.token.addr).balanceOf(this) - beforeBalance;
}
+ _position.EUROs -= costInEuros;
+ rewards[abi.encodePacked(_position.holder, + asset.token.symbol)] += _portion;
+ burnEuros += costInEuros;
Updates

Lead Judging Commences

hrishibhat Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

fee-on-transfer

hrishibhat Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

fee-on-transfer

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.