Tadle
Tadle
DeFi
30,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Incompatible with transfer-on-fee/deflationary tokens in TokenManager

vineyard

Summary

The Transfer-on-Fee and Deflationary Tokens handling is not supported in TokenManagerwhich is in conflict with the Compatibilities in the project scope page, since those tokens would also fulfill the ERC20 standard.

Vulnerability Details

The TokenManager contract in src/core/TokenManager.sol (lines 255-261) implements strict balance checks after token transfers.

if (fromBalanceAft != fromBalanceBef - _amount) {
revert TransferFailed();
}
​
if (toBalanceAft != toBalanceBef + _amount) {
revert TransferFailed();
}

These checks assume that the recipient's balance increases by exactly the amount sent and the sender's balance decreases by the same amount. This assumption does not hold for transfer-on-fee or deflationary tokens, which may reduce the transferred amount during the transaction. However, the ERC20 standard would still hold for these tokens, as mentioned in the compatibilities section of the project.

Compatibilities:\
Blockchains:\
\- Ethereum/Any EVM\
Tokens:\
\- ETH\
\- WETH\
\- ERC20 (any token that follows the ERC20 standard)
​

Ref: https://github.com/d-xo/weird-erc20

Impact

Transactions involving transfer-on-fee or deflationary tokens will be failed.

Tools Used

Manual

Recommendations

There could be a few workarounds:

  1. Preset potential fee rate based on different token

  2. Holding data for the actual deposit amount(Till in) in TokenManager. (relative offer info should also managed)

Updates

Lead Judging Commences

0xnevi Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-TokenManager-FOT-Rebasing

Valid medium, there are disruptions to the ability to take market actions. The following functions will be disrupted without the possibiliy of reaching settlement, since the respective offers cannot be created/listed regardless of mode when transferring collateral token required to the CapitalPool contract or when refunding token from user to capital pool during relisting. So withdrawal is not an issue - `createOffer()` - reverts [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/PreMarkets.sol#L96-L102) - `listOffer()` - reverts [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/PreMarkets.sol#L355-L362) - `relistOffer()` - reverts [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/PreMarkets.sol#L515-L521) - `createTaker()` - reverts [here](https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/PreMarkets.sol#L831-L836) I believe medium severity is appropriate although the likelihood is high and impact is medium (only some level of disruption i.e. FOT tokens not supported and no funds at risk)

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.