The Standard

Summary

Some functions do not work correctly with fee-on-transfer tokens.

Vulnerability Details

Some tokens take a transfer fee (e.g. STA, PAXG), some do not currently charge a fee but may do so in the future (e.g. USDT, USDC).

Should a fee-on-transfer token be added as an asset and deposited, it could be abused, as the accounting is wrong. In the current implementation the following function calls do not work well with fee-on-transfer tokens as the amount variable is the pre-fee amount, including the fee, whereas the final balance do not include the fee anymore.

Impact

See vulnerability details

Tools Used

Manual Review

Recommendations

Consider correct handling of fee-on-transfer tokens.