Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Denial of Service Due to Incompatibility of Fee-On-Transfer Tokens.

0xgenaudits

Summary

The protocol is vulnerable to fee-on-transfer token within a smart contract,
where transactions involving a transfer-on-transfer operation consistently result in a revert.
This flaw rooted in the contract's logic, causes a Denial of Service (DoS) as it prevents successful execution
of token transfers.

Sponsor says:

ERC20 (any token that follows the ERC20 standard)

Vulnerability Details

The issue arises due to the way the fee-on-transfer works, When the transfer function is called,
transfer-on-transfer tokens apply fee. However, due to a logical flaw or an unhandled edge case
in the _transfer, this transfer-on-transfer operation will always revert.


The exact line of code causing this issue could be related to:
This line: https://github.com/Cyfrin/2024-08-tadle/blob/main/src/core/TokenManager.sol#L259-L261

File: https://github.com/Cyfrin/2024-08-tadle/blob/main/src/core/TokenManager.sol#L233-L262

POC:

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;
​
contract Test {
error TransferFailed();
mapping(address => uint256) public balanceOf;
function init() public {
// Mock balance
balanceOf[address(0x11111)] = 200;
balanceOf[address(0x99999)] = 0;
​
Test_Fee_on_transfer(address(0x11111), address(0x99999), 100);
}
​
function Test_Fee_on_transfer(address _from, address _to, uint256 _amount) public {
// Mock Fee
uint256 Mock_Fee = 5;
​
uint256 fromBalanceBef = balanceOf[_from];
uint256 toBalanceBef = balanceOf[_to];
​
balanceOf[_from] = fromBalanceBef - _amount;
@>>> // @notice Mock Token takes a fee
@>>> // _amount: 100 - Mock_Fee: 5 -> 95
@>>> uint256 receiver_get_amount = _amount - Mock_Fee;
@>>> balanceOf[_to] = toBalanceBef + receiver_get_amount;
​
uint256 fromBalanceAft = balanceOf[_from];
uint256 toBalanceAft = balanceOf[_to];
​
if (fromBalanceAft != fromBalanceBef - _amount) {
revert TransferFailed();
}
​
@>>> // @notice transaction will revert here.
@>>> // toBalanceAft: 95 != toBalanceBef: 0 + _amount: 100 -> true
if (toBalanceAft != toBalanceBef + _amount) {
revert TransferFailed();
}
}
}

Result:

Error: VM Exception while processing transaction: reverted with custom error 'TransferFailed()'

Impact

denial of Service when fee-on-transfer token used the transaction will revert.

Tools Used

Recommendations

Update code to be compatible with fee-on-transfer.

Updates

Lead Judging Commences

0xnevi Lead Judge 12 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-TokenManager-FOT-Rebasing

Valid medium, there are disruptions to the ability to take market actions. The following functions will be disrupted without the possibiliy of reaching settlement, since the respective offers cannot be created/listed regardless of mode when transferring collateral token required to the CapitalPool contract or when refunding token from user to capital pool during relisting. So withdrawal is not an issue - `createOffer()` - reverts [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/PreMarkets.sol#L96-L102) - `listOffer()` - reverts [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/PreMarkets.sol#L355-L362) - `relistOffer()` - reverts [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/PreMarkets.sol#L515-L521) - `createTaker()` - reverts [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/PreMarkets.sol#L831-L836) I believe medium severity is appropriate although the likelihood is high and impact is medium (only some level of disruption i.e. FOT tokens not supported and no funds at risk)

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.