Tadle

Summary

The tillIn() function transfers tokens to a capital pool. However, the internal _transfer() function does not account for tokens that charge a fee on transfer. This leads to an erroneous balance check, causing the transaction to revert even when the transfer is successful but includes a fee.

Vulnerability Details

The tillIn() function handles token transfers to a capital pool, distinguishing between native tokens and ERC20 tokens. When handling ERC20 tokens, it calls the internal _transfer() function:

The vulnerability lies in the _transfer function's balance checks. It assumes that the amount transferred will be exactly equal to the amount deducted from the sender and added to the recipient. This assumption fails for tokens that charge a transfer fee (e.g., STA, PAXG), as the balance added to the recipient will be less than the amount deducted from the sender.

Affected LoC:

• https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/TokenManager.sol#L259

Impact

For tokens that charge a transfer fee, the balance check will fail, causing the transaction to revert. This results in a denial of service (DoS) for users attempting to transfer such tokens, as the contract does not accommodate the fee-on-transfer mechanism.

Tools Used

Manual

Recommendations

To address this issue, the balance checks should be modified to accommodate tokens that charge a transfer fee. Instead of directly comparing the expected balance changes, the function should verify that the recipient received at least the minimum expected amount.