Tadle

Summary

Rebasing tokens, which are tokens that can automatically adjust balances over time due to mechanisms like interest accrual or airdrops, are not properly handled by the Tadle protocol. This oversight can lead to potential losses for both users and the protocol.

Vulnerability Details

Rebasing tokens dynamically change a user's balance without requiring any action from the user. This can happen due to mechanisms such as interest accrual, inflation, or airdrops.

In the Tadle protocol, when tokens are deposited into a user's account via the TokenManager::addTokenBalance function, the protocol updates the userTokenBalanceMap state to reflect the deposit. However, the protocol assumes that the token balance remains static, which is not the case with rebasing tokens.

Key Code Section:

Issues:

• Missed Gains: If a user deposits a rebasing token, the gains from the rebase (increased balance) will not be properly reflected in their Tadle account. This means users could miss out on additional tokens that would have otherwise accrued.

• Inaccurate Accounting: Conversely, if a token undergoes a negative rebase (balance decreases), the protocol may still reflect the pre-rebase balance, leading to inaccurate accounting and potential overvaluation of collateral.

Impact

• User Impact: Depositors may miss out on gains that should have accrued while their assets were locked as collateral in Tadle.

• Protocol Impact: Tadle could suffer losses if it continues to overvalue collateral after a negative rebase, leading to an increased risk of bad debt.

Tools Used

Manual code review.

Recommendations

1. Documentation: Clearly document that rebasing tokens is not supported as collateral within the protocol. This will help inform users and prevent unintended consequences.

2. Handle Rebasing Tokens: If supporting rebasing tokens is necessary, implement balance checks before and after token transfers to account for any changes in the token balance. This will ensure accurate accounting and prevent potential losses.

3. Periodic Balance Updates: Implement periodic updates to user balances for rebasing tokens, ensuring that the protocol and the users are in sync with the current token balances.

Implementing these recommendations will mitigate risks associated with rebasing tokens and ensure that the protocol accurately reflects user balances.