The _lock function expects to receive the full transfer amount (_quantity).
However, the _lock function does not account for tokens that apply a fee on transfer, which will result in the contract receiving less than _quantity in case of fee on transfer tokens.
lockedToken.quantity += _quantity;
The function records the full _quantity without checking if the actual received amount is less due to fees.
Tools Used
Recommended Mitigation Steps
Use balanceOf before and after the transferFrom call to get the real amount of tokens received.
Lines of code
https://github.com/code-423n4/2024-05-munchables/blob/57dff486c3cd905f21b330c2157fe23da2a4807d/src/managers/LockManager.sol/#L311
Vulnerability details
Impact
lockedToken quantity will be inflated for fee on transfer tokens. It will not reflect the real amount.
Proof of Concept
According to the readme, fee on transfer token behaviour is in scope. However, fee on transfer tokens are not handled in the _lock function
The
_lock
function expects to receive the full transfer amount (_quantity
).However, the _lock function does not account for tokens that apply a fee on transfer, which will result in the contract receiving less than
_quantity
in case of fee on transfer tokens.The function records the full
_quantity
without checking if the actual received amount is less due to fees.Tools Used
Recommended Mitigation Steps
Use balanceOf before and after the
transferFrom
call to get the real amount of tokens received.Assessed type
ERC20