Incompatibility With Rebasing/Deflationary/Inflationary tokens

[code423n4]

Lines of code

https://github.com/code-423n4/2022-12-Stealth-Project/blob/fc8589d7d8c1d8488fd97ccc46e1ff11c8426ac2/maverick-v1/contracts/models/Pool.sol#L300

Vulnerability details

Impact

The Maverick AMM does not appear to support rebasing/deflationary/inflationary tokens whose balance changes during transfers or over time. The necessary checks include at least verifying the amount of tokens transferred to contracts before and after the actual transfer to infer any fees/interest.

Tools Used

Manual Code Review

Recommended Mitigation Steps

Maverick AMM can note in the project description or in the website that those tokens are not supported. If similar tokens are planned to be supported:

• Make sure that the protocol accounts for any rebasing/inflation/deflation
• Add support in contracts for such tokens before accepting user-supplied tokens
• Consider to check before/after balance on the Pair contract.

[kirk-baird]

This issue does not sufficiently describe any exploit paths or how rebasing tokens / FoT tokens can cause a loss of funds.

[c4-judge]

kirk-baird marked the issue as unsatisfactory: Invalid