Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Locking Mechanism Flaw in Rebasing Tokens.

0xgenaudits

Summary

This report outlines a critical vulnerability related to rebasing tokens, Rebasing tokens dynamically
adjust their balances based on predefined conditions, causing balances to increase or decrease over time.
This feature introduces significant challenges when locking tokens, as the stored amount in the contract
may not accurately reflect the user's actual token balance after the rebase occurs.

Vulnerability Description

Rebasing tokens like USDB inherently alter the balance of holders through periodic adjustments.
When a user transfers a specific amount of USDB tokens to a contract for locking purposes,
the contract typically stores the transferred amount in its internal storage. However,
due to the nature of rebasing, the recorded amount may become inaccurate over time.

function createOffer(CreateOfferParams memory params) public payable {
// @dev update offer info
offerInfoMap[offerAddr] = OfferInfo({
id: offerId,
authority: _msgSender(),
maker: makerAddr,
offerStatus: OfferStatus.Virgin,
offerType: params.offerType,
points: params.points,
@>>> amount: params.amount,
collateralRate: params.collateralRate,
abortOfferStatus: AbortOfferStatus.Initialized,
usedPoints: 0,
tradeTax: 0,
settledPoints: 0,
settledPointTokenAmount: 0,
settledCollateralAmount: 0
});
}

Impact

Potential Loss: Depending on the rebase mechanism, this vulnerability could result in significant financial loss,
either for individual users or for the entire contract’s ecosystem.

Recommended

Consider implementing a system to handle rebasing tokens.

Updates

Lead Judging Commences

0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-TokenManager-FOT-Rebasing

Valid medium, there are disruptions to the ability to take market actions. The following functions will be disrupted without the possibiliy of reaching settlement, since the respective offers cannot be created/listed regardless of mode when transferring collateral token required to the CapitalPool contract or when refunding token from user to capital pool during relisting. So withdrawal is not an issue - `createOffer()` - reverts [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/PreMarkets.sol#L96-L102) - `listOffer()` - reverts [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/PreMarkets.sol#L355-L362) - `relistOffer()` - reverts [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/PreMarkets.sol#L515-L521) - `createTaker()` - reverts [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/PreMarkets.sol#L831-L836) I believe medium severity is appropriate although the likelihood is high and impact is medium (only some level of disruption i.e. FOT tokens not supported and no funds at risk)

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.