Tadle

Summary

When maker creates an offer with fee on transfer token exchanging, he will face TransferFailed revert, due to fee on transfer tokens token transfer's bad handle

Vulnerability Details

As we can see from the sponsor's provided compabilities, the protocol is expected co compile with weird ERC20s, that take fee on transfer: - ERC20 (any token that follows the ERC20 standard)

However let's see what happens in scenario where maker decides to call PreMarkets::createOffer with param CreateOfferParams.tokenAddress == address of ERC20Token that have fee on transfer:

1. Bob calls PreMarkets::createOffer with CreateOfferParams.tokenAddress == fee on tansfer ERC20Token

2. During the execution TokenManager::tillInis called and TokenManager::_transferis executed

   function createOffer(CreateOfferParams calldata params) external payable {

   ....

   ​

   {

   /// @dev transfer collateral from _msgSender() to capital pool

   uint256 transferAmount = OfferLibraries.getDepositAmount(

   params.offerType,

   params.collateralRate,

   params.amount,

   true,

   Math.Rounding.Ceil

   );

   ​

   ITokenManager tokenManager = tadleFactory.getTokenManager();

   -> tokenManager.tillIn{value: msg.value}(

   _msgSender(),

   params.tokenAddress,

   transferAmount,

   false

   );

   }

   ​

   ....

   }

   ​

   function tillIn(

   address _accountAddress,

   address _tokenAddress,

   uint256 _amount,

   bool _isPointToken

   )

   external

   payable

   onlyRelatedContracts(tadleFactory, _msgSender())

   onlyInTokenWhiteList(_isPointToken, _tokenAddress)

   {

   ....

   } else {

   /// @notice token is ERC20 token

   -> _transfer(

   _tokenAddress,

   _accountAddress,

   capitalPoolAddr,

   _amount,

   capitalPoolAddr

   );

   }

   ​

   emit TillIn(_accountAddress, _tokenAddress, _amount, _isPointToken);

   }

   ​

3. As we can see from the last check in TokenManager::_transferthe function will revert because of toBalanceAft != toBalanceBef + amount_ (actual toBalanceAft = toBalanceBef +_ amount - transferFee)

Impact

DoS if createOffer is called with CreateOfferParams.tokenAddress that have fee on transfer

Tools Used

Manual review

Recommendations

There are 2 steps needed to solve the issue:

1. Rewrite the _transfer function as shown below:

2. Add more code logic to return the deposited value(toBalanceAft - toBalanceBef) and if it's < _amount, decrease the _amount and points value in the corresponding offerInfo and stockInfo