Tadle

Summary

Different ERC-20 token implementations behave differently regarding the actual amount received when transferring tokens. For example, USDT on Ethereum (Fee on Transfer Token) can charge a fee when transferring ERC-20 tokens, meanwhile, STA (Deflationary Token) burns a certain percentage of the transferred amount.

These types of tokens (collectively known as Weird ERC20 tokens) are currently not applicable to the logic of the current Tadle contracts.

Vulnerability Details

Let's look at the TokenManager.sol contract's _transfer() internal function :

In the above function, after invoking _safe_transfer_from() function (essentially calling the ERC20 contract function using TRANSFER_FROM_SELECTOR in Rescuable.sol contract), there is a logic to check whether the balance delta between before and after transfer of _from address and _to address is exactly equal to amount or not.

As mentioned in the summary section, there are some tokens that, although still comply with the ERC20 standard, customize the logic of the transfer function according to their business logic. This customization leads to the fact that the actual amount sent to the _to address will not be equal to the input amount and it will not pass the delta balance check logic mentioned above.

Impact

All current Tadle's features when applied to Weird ERC20 Tokens will always revert TransferFailed()

Tools Used

Manually Review

Recommendations

Solution 1: Remove the logic checking balance delta before and after performing token transfer of TokenManager.sol contract's _transfer() internal function.

Solution 2: Disallow Weird ERC20 tokens to be used on Tadle marketplace (not added to token whitelist)