search

code-423n4 / 2021-07-pooltogether-findings

0 stars 0 forks source link

Deposits don't work with fee-on transfer tokens #58

Closed code423n4 closed 3 years ago

code423n4 commented 3 years ago

Handle

cmichel

Vulnerability details

There are ERC20 tokens that may make certain customizations to their ERC20 contracts. One type of these tokens is deflationary tokens that charge a certain fee for every transfer() or transferFrom(). Others are rebasing tokens that increase in value over time like Aave's aTokens (balanceOf changes over time).

Impact

The MStableYieldSource/SwappableYieldSource.supplyTokenTo() function will fail when the underlying token is a fee-on transfer token.

Recommended Mitigation Steps

One possible mitigation is to measure the asset change right before and after the asset-transferring routines

PierrickGT commented 3 years ago

Duplicate of https://github.com/code-423n4/2021-07-pooltogether-findings/issues/52