[M-03] Protocol Won't Work With Fee-On-Transfer Tokens

Summary

Tokens implementing a fee-on-transfer mechanism, which deduct a fee from the recipient on each transfer, are incompatible with the current implementation of the TokenManager::_transfer function. This incompatibility arises because the _transfer function includes a check to verify whether the recipient's balance has been correctly incremented by the transferred amount. Since fee-on-transfer tokens adjust the recipient's balance after deducting the fee, this check fails, preventing users from depositing or withdrawing these types of tokens.

Vulnerability Details

The problematic check within the _transfer function ensures that the recipient's balance (toBalanceAft) equals the initial balance plus the transferred amount (toBalanceBef + _amount). However, for tokens with a fee-on-transfer feature, the actual balance increase is less due to the fee deduction, causing the check to revert.

Impact

The inability to handle fee-on-transfer tokens limits the protocol's compatibility with a broader range of ERC20-compliant tokens, potentially excluding users who wish to interact with these tokens within the protocol.

Proof of Concept

To demonstrate this issue, consider integrating a fee-on-transfer token into the testing environment and attempting to perform operations with it:

Install the library of wierd tokens and import it in test file:

Run the following test in exsiting test suit:

Tools Used

Manual Review

Recommendations

To resolve this issue, consider removing the balance check entirely or modifying it to account for the fee deducted during the transfer. Alternatively, introduce a parameter to specify the fee rate for tokens with a fee-on-transfer mechanism, allowing the protocol to accurately calculate the expected recipient balance post-transfer.