Users Can Trivially Bypass Transfer Fees By Wrapping Vader/Vether Tokens

[code423n4]

Handle

jvaqa

Vulnerability details

Impact

Users Can Trivially Bypass Transfer Fees By Wrapping Vader/Vether Tokens

Vader.sol and Vether.sol implement a _fee on every transfer, when the sender and recipient are not on a special excludedAddresses list. However, users can bypass these fees by creating a wrapper contract around either Vader or Vether. All users will have an economic incentive to use the wrapped version, rather than the unwrapped version with fees.

Proof of Concept

Alice can create a very simple 1-to-1-backed ERC20 wrapper contrac, one contract for Vether and one contract for Vader. It will mint/burn an equivalent number of tokens for every unit of the underlying sent/retrieved from the wrapper contract. Since users have an economic incentive to use this alternative contract, they will.

Recommended Mitigation Steps

Remove fees on transfer. This pattern is generally discouraged since it is trivial to work around, and users have an economic incentive to work around it and adopt the wrapped version of the underlying token.

[strictly-scarce]

Most FoT will be collected from the Router and redemptions, where wrapped tokens not applicable.

[dmvt]

agree with sponsor... in addition to @strictly-scarce's comment, gas costs alone disincentivize a user from using a wrapped contract to bypass fees