Tadle

Summary

Protocol does not support fee-on-transfer and rebasing tokens.

Vulnerability Details

As the protocol is going to deal with many ERC20, so it's execution will get failed for fee on transfer tokens and rebasing tokens.

Some tokens take a transfer fee (e.g. STA, PAXG), some do not currently charge a fee but may do so in the future (e.g. USDT, USDC).

TokenManager:_transfer() is used to transfer funds from One Account to other, It has the following implementation

Also before/after it is called we have code like this:

and this

This code does not account for tokens that have a fee-on-transfer or a rebasing (token balance going up/down without transfers) mechanisms. By caching (or removing) the amount given to the transfer or transferFrom methods of the ERC20 token, this implies that this will be the actual received/sent out amount by the protocol and that it will be static, but that is not guaranteed to be the case. If fee-on-transfer tokens are used, on deposit action the actual received amount will be less, so withdrawing the same balance won't be possible. For rebasing tokens it is also possible that the contract's balance decreases over time, which will lead to the same problem as with the fee-on-transfer tokens, and if the balance increases then the reward will be stuck in the AssetManager contract.

Impact

High, as this can leave tokens stuck in the protocol

Tools Used

Manual

Recommendations

For fee-on-transfer tokens, check the balance before and after the transfer and validate it is the same as the amount argument provided. For rebasing tokens, when they go down in value, you should have a method to update the cached reserves accordingly, based on the balance held. This is a complex solution. For rebasing tokens, when they go up in value, you should add a method to actually transfer the excess tokens out of the protocol (possibly directly to users).