Fee-on-transfer/rebasing tokens will have problems when swapping

[code423n4]

Lines of code

---

110

Vulnerability details

---

Uniswap v3 does not support rebasing or fee-on-transfer tokens so using these tokens with it will result funds getting stuck. With fee-on-transfer tokens, if the balance isn't checked, the wrong amount may be transferred out. With rebasing tokens, the contract may have some remaining residual balance after the fixed amount is transferred out. Uniswap v2 does support them but only with the "SupportingFeeOnTransfer" swap variants.

File: contracts/Swapper/CurveSwapper.sol

110              yieldBox
111          );
112  
113          // Retrieve tokens from sender or from YieldBox
114          amountIn = _extractTokens(
115              swapData.yieldBoxData,
116              yieldBox,
117              tokenIn,
118              swapData.tokensData.tokenInId,
119              amountIn,
120              swapData.amountData.shareIn
121          );
122  
123          // Swap & compute output
124          amountOut = _swapTokensForTokens(
125              int128(int256(tokenIndexes[0])),
126              int128(int256(tokenIndexes[1])),
127              amountIn,
128              amountOutMin
129          );
130          if (swapData.yieldBoxData.depositToYb) {
131              _safeApprove(tokenOut, address(yieldBox), amountOut);
132              (, shareOut) = yieldBox.depositAsset(
133                  swapData.tokensData.tokenOutId,
134                  address(this),
135                  to,
136                  amountOut,
137                  0
138              );
139          } else {
140              IERC20(tokenOut).safeTransfer(to, amountOut);
141          }
142:     }

Assessed type

---

other

[C4-Staff]

@geoffchan23 Sponsors can only use these labels: sponsor confirmed, sponsor disputed, sponsor acknowledged.

[C4-Staff]

@geoffchan23 Sponsors are not allowed to close, reopen, or assign issues or pull requests.