Tadle

Summary

The _transfer() function in the tokenManager.sol contract does not account for tokens that implement a fee on transfer, which can lead to transaction failures. The function expects the balances before and after the transfer to change by exactly the transferred amount, which is not the case for fee-on-transfer tokens.

Vulnerability Details

In the _transfer() function, the code checks if the from balance decreases by the exact amount and if the to balance increases by the same amount. This logic assumes that the token does not deduct any fees during the transfer. However, for tokens with a fee on transfer, the actual amount received by the to address will be less than _amount, causing the function to revert with a TransferFailed error.

Issue is because of this check

Impact

This issue will cause the _transfer() function to fail when dealing with fee-on-transfer tokens. It could prevent users from using such tokens with the protocol, limiting the protocol's flexibility and compatibility with different ERC-20 tokens.

Tools Used

Manual Review

Recommendations

Modify Balance Checks: Adjust the balance checks to account for possible fees during the transfer. This can be done by removing the exact balance check and instead verifying that the to balance has increased.