search

code-423n4 / 2022-04-backed-findings

1 stars 1 forks source link

Consistently check account balance before and after transfers for Fee-On-Transfer discrepancies #133

Closed code423n4 closed 2 years ago

code423n4 commented 2 years ago

Lines of code

https://github.com/code-423n4/2022-04-backed/blob/main/contracts/NFTLoanFacilitator.sol#L155 https://github.com/code-423n4/2022-04-backed/blob/main/contracts/NFTLoanFacilitator.sol#L159 https://github.com/code-423n4/2022-04-backed/blob/main/contracts/NFTLoanFacilitator.sol#L203

Vulnerability details

Impact

Wrong amount calculated for facilitatorTake

Proof of Concept

Arbitrary ERC20 tokens can be passed as loanAssetContractAddress. With a transfer, the received amount should be calculated every time to take into consideration a possible fee-on-transfer or deflation. Also, it's a good practice for the future of the solution.

Recommended Mitigation Steps

Use the balance before and after the transfer to calculate the received amount instead of assuming that it would be equal to the amount passed as a parameter in the ERC20(loanAssetContractAddress).safeTransferFrom() function.

wilsoncusack commented 2 years ago

132

gzeoneth commented 2 years ago

Duplicate of https://github.com/code-423n4/2022-04-backed-findings/issues/75