Open code423n4 opened 2 years ago
not does apply for our use case
As the vault token adheres to the VaultToken
contract, there is no expectation that fee on transfer tokens may be used instead of the provided implementation.
Will keep this as non-critical
for future reference.
Handle
WatchPug
Vulnerability details
There are ERC20 tokens that charge fee for every
transfer()
ortransferFrom()
.In the current implementation,
YaxisVaultAdapter.sol#withdraw()
assumes that the received amount is the same as the transfer amount.https://github.com/code-423n4/2021-11-yaxis/blob/146febcb61ae7fe20b0920849c4f4bbe111c6ba7/contracts/v3/alchemix/adapters/YaxisVaultAdapter.sol#L68-L72
Recommended
Consider calling
balanceOf()
to get the actual balances.