search

code-423n4 / 2021-05-88mph-findings

0 stars 0 forks source link

Incompatability with deflationary / fee-on-transfer tokens #16

Open code423n4 opened 3 years ago

code423n4 commented 3 years ago

Handle

cmichel

Vulnerability details

Vulnerability Details

The DInterest.deposit function takes a depositAmount parameter but this parameter is not the actual transferred amount for fee-on-transfer / deflationary (or other rebasing) tokens.

Impact

The actual deposited amount might be lower than the specified depositAmount of the function parameter. This would lead to wrong interest rate calculations on the principal.

Recommended Mitigation Steps

Transfer the tokens first and compare pre-/after token balances to compute the actual deposited amount.

ZeframLou commented 3 years ago

While this is true, we have no plans to support fee-on-transfer or rebasing tokens.