Summary

Contracts are vulnerable to rebasing accounting-related issues

Vulnerability Details

Rebasing tokens are tokens that have each holder's balanceOf increase over time. Aave aTokens are an example of such tokens.

Impact

If rebasing tokens are used, rewards accrue to the contract holding the tokens, and cannot be withdrawn by the original depositor.

Tools Used

Manual Review

Recommendations

To address the issue, track 'shares' deposited on a pro-rata basis, and let shares be redeemed for their proportion of the current balance at the time of the withdrawal.