User will lose rewards from rebasing tokens
Summary
When users deposit a rebasing token to the capital pool, their balances are stored in a userTokenBalanceMap which will not accrue the daily rewards of tokens like stETH and AMPL.
Vulnerability Details
Suppose a user deposits an offer with a collateral of 1 stETH. The offer stays open for two months, but there are no takers and the owner closes the offer and withdraws his stETH. The withdrawn amount will have missed 2 months of staking rewards.
The staking rewards will still be available inside the capital pool, but they won't reflect on the user's claimable balance.
I am aware that Tadle works with a whitelist, however because tokens such as wstETH are so present in financial contracts, the administrator might mistakenly whitelist it when despite his code not supporting rebases.
Impact
Users will lose money on this, funds are directly at risk.
Tools Used
n/a
Recommendations
Either implement a function to be run daily reflecting token accruals to claimable balances and collaterals of offerings, or explicitly do not support them.
Lead Judging Commences
finding-TokenManager-FOT-Rebasing
Valid medium, there are disruptions to the ability to take market actions. The following functions will be disrupted without the possibiliy of reaching settlement, since the respective offers cannot be created/listed regardless of mode when transferring collateral token required to the CapitalPool contract or when refunding token from user to capital pool during relisting. So withdrawal is not an issue - `createOffer()` - reverts [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/PreMarkets.sol#L96-L102) - `listOffer()` - reverts [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/PreMarkets.sol#L355-L362) - `relistOffer()` - reverts [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/PreMarkets.sol#L515-L521) - `createTaker()` - reverts [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/PreMarkets.sol#L831-L836) I believe medium severity is appropriate although the likelihood is high and impact is medium (only some level of disruption i.e. FOT tokens not supported and no funds at risk)
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.