Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Incompatibility with Fee-on-Transfer Tokens

0xasp

Summary

The current implementation of the _transfer function in the TokenManager contract is incompatible with fee-on-transfer tokens. This function assumes that the exact amount specified is transferred, which is not true for fee-on-transfer tokens where a portion of the transfer is deducted as a fee.

The contest description says any token that follows the ERC20 standard is supported.

Vulnerability Details

The _transfer function in the TokenManager contract called during by tillIn() method, performs strict balance checks that are incompatible with fee-on-transfer token mechanics. For these tokens, the received amount is always less than the sent amount due to the fee deduction during transfer.

https://github.com/Cyfrin/2024-08-tadle/blob/main/src/core/TokenManager.sol#L233

if (fromBalanceAft != fromBalanceBef - _amount) {
revert TransferFailed();
}
​
if (toBalanceAft != toBalanceBef + _amount) {
revert TransferFailed();
}

Impact

This makes the key methods of the protocol to always revert for fee-on-transfer tokens, costing gas fee to the users, which is not an expected behaviour.

Affected methods:

  • createOffer()

  • listOffer()

  • relistOffer()

  • settleAskMaker()

  • settleAskTaker()

Tools Used

Manual review.

Recommendations

Modify the _transfer function to accommodate fee-on-transfer tokens.

uint256 fromBalanceAft = IERC20(_token).balanceOf(_from);
uint256 toBalanceAft = IERC20(_token).balanceOf(_to);
​
- if (fromBalanceAft != fromBalanceBef - _amount) {
- revert TransferFailed();
- }
​
- if (toBalanceAft != toBalanceBef + _amount) {
- revert TransferFailed();
- }
+ uint256 sentAmount = fromBalanceBef - fromBalanceAft;
+ actualTransferredAmount = toBalanceAft - toBalanceBef;
​
+ if (sentAmount != _amount) {
+ revert TransferFailed();
+ }
Updates

Lead Judging Commences

0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-TokenManager-FOT-Rebasing

Valid medium, there are disruptions to the ability to take market actions. The following functions will be disrupted without the possibiliy of reaching settlement, since the respective offers cannot be created/listed regardless of mode when transferring collateral token required to the CapitalPool contract or when refunding token from user to capital pool during relisting. So withdrawal is not an issue - `createOffer()` - reverts [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/PreMarkets.sol#L96-L102) - `listOffer()` - reverts [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/PreMarkets.sol#L355-L362) - `relistOffer()` - reverts [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/PreMarkets.sol#L515-L521) - `createTaker()` - reverts [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/PreMarkets.sol#L831-L836) I believe medium severity is appropriate although the likelihood is high and impact is medium (only some level of disruption i.e. FOT tokens not supported and no funds at risk)

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.