Deflationary tokens deduct a fee in transfers which causes their amount transferred to be less than that specified. Given the intended support of stablecoins: DAI, USDC and USDT, USDT has the potential to become deflationary because of non-0 fee functionality that maybe enabled. The codebase doesn't seem to support accounting for deflationary tokens because it does not calculate the before-and-after balances to account for such token transfers.
Haz077
commented
3 years ago
Handle
0xRajeev
Vulnerability details
Impact
Deflationary tokens deduct a fee in transfers which causes their amount transferred to be less than that specified. Given the intended support of stablecoins: DAI, USDC and USDT, USDT has the potential to become deflationary because of non-0 fee functionality that maybe enabled. The codebase doesn't seem to support accounting for deflationary tokens because it does not calculate the before-and-after balances to account for such token transfers.
Proof of Concept
https://github.com/code-423n4/2021-09-yaxis/blob/cf7d9448e70b5c1163a1773adb4709d9d6ad6c99/contracts/v3/converters/StablesConverter.sol#L25
https://github.com/code-423n4/2021-09-yaxis/blob/cf7d9448e70b5c1163a1773adb4709d9d6ad6c99/contracts/v3/converters/StablesConverter.sol#L47
Tools Used
Manual Analysis
Recommended Mitigation Steps
Evaluate support for tokens that have the potential to become deflationary such as USDT.