Tadle

Summary

The protocol's token transfer implementation is not compatible with fee-on-transfer and rebasing tokens, leading to failed token transfers for such ERC20 tokens.

Vulnerability Details

The protocol's _transfer function in TokenManager.sol performs balance checks before and after the token transfer to ensure the transfer was successful. However, these checks do not account for the behavior of fee-on-transfer and rebasing tokens, which can cause the balances to change in ways that trigger the function's revert conditions.

This is how _transfer function is implemented in TokenManager.sol:

Impact

Fee-on-transfer tokens deduct a fee from the amount being transferred, which means the recipient's balance will increase by less than the sent amount. This will cause the balance check toBalanceAft != toBalanceBef + _amount to fail and the transfer to be reverted`.
Similarly, rebasing tokens can increase the balance of the token holder, which will also cause the balance checks to fail and the transfer to be reverted.

Tools Used

The function will revert all transfers of fee-on-transfer and rebasing ERC20 tokens, making them unusable in this system.

Recommendations

To address this issue, the protocol should modify the _transfer function to properly handle fee-on-transfer and rebasing tokens. One possible solution is to use the actual transferred amount (which may be less than the sent amount due to fees) when performing the balance checks, rather than the sent amount.