Tadle

Summary

The _transfer function incorrectly assumes that the balance of the sender and receiver will change exactly by the amount being transferred. This assumption is flawed, particularly when dealing with ERC-20 tokens that implement fee-on-transfer mechanisms or other non-standard behaviors. This oversight could lead to unexpected reverts and failures in token transfers, potentially disrupting the contract's functionality.

Vulnerability Details

The function performs strict equality checks for both the sender's and receiver's balances, which does not account for tokens with fee-on-transfer mechanisms

In cases where a token applies a transfer fee, the balance checks will fail, causing the transfer to revert even though it was successful from the token's perspective.

Impact

Incorrect balance checks can cause token transfers to fail, especially with tokens that have non-standard behaviors like fees on transfers. This can disrupt contract functionality, lead to failed transactions, and limit compatibility with a range of ERC-20 tokens.

Tools Used

Recommendations

Update the balance checks to account for potential discrepancies due to fees or other deductions. The checks should ensure that the balance changes are at least as expected but allow for additional reductions due to token-specific behaviors.