TempleGold
TempleDAO
Foundry
25,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

`SpiceAuction` doesn't work with Rebase Token

jesjupyter

Summary

It is stated that any Fee-on-transfer token is not supported. However, it should also be noted that rebase tokens like wstETH are also not supported since they would cause issues in balance-accounting.

Vulnerability Details

Currently, fee-on-transfer tokens are not supported because they will be accounted for in depositors[msg.sender][epochId] and info.totalBidTokenAmount += amount.

uint256 _bidTokenAmountBefore = IERC20(bidToken).balanceOf(_recipient);
IERC20(bidToken).safeTransferFrom(msg.sender, _recipient, amount);
uint256 _bidTokenAmountAfter = IERC20(bidToken).balanceOf(_recipient);
// fee on transfer tokens
if (amount != _bidTokenAmountAfter - _bidTokenAmountBefore) { revert CommonEventsAndErrors.InvalidParam(); }
depositors[msg.sender][epochId] += amount;
info.totalBidTokenAmount += amount;

However, rebase tokens like wstETH could also pass the test as their balances only increase over time. Using rebase tokens will cause balance-accounting issues and result in some extra funds being stuck in the contract.

Impact

Using rebase tokens will cause balance-accounting issues and lead to some extra funds being stuck in the contract.

Tools Used

Manual

Recommendations

To mitigate:

  • Consider recording shares for users instead of absolute token amounts.

  • Explicitly state that rebase tokens are also unsupported in the contract documentation.

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Known issue
Assigned finding tags:

Rebasing

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.