The project description states it supports fee on transfer ERC20 tokens, however, the contract does not handle this token properly, leading to constract insolvent.
Proof of Concept
The _lock() function tracks the quantity of tokens users lockup. _lock()#L380:
lockedToken.quantity += _quantity;
When tokens are unlocked, users can withdraw the same quantity of tokens from the contract. unlock()#L423:
token.transfer(msg.sender, _quantity);
However, as the contract receives less tokens than the provided _quantity due to the transfer fee, the contract would not have sufficient tokens for withdrawal, leading to users cannot unlock their tokens.
Tools Used
vscode
Recommended Mitigation Steps
Consider implement the support for fee-on-transfer tokens.
Lines of code
https://github.com/code-423n4/2024-05-munchables/blob/57dff486c3cd905f21b330c2157fe23da2a4807d/src/managers/LockManager.sol#L380 https://github.com/code-423n4/2024-05-munchables/blob/57dff486c3cd905f21b330c2157fe23da2a4807d/src/managers/LockManager.sol#L423
Vulnerability details
Impact
The project description states it supports fee on transfer ERC20 tokens, however, the contract does not handle this token properly, leading to constract insolvent.
Proof of Concept
The
_lock()
function tracks the quantity of tokens users lockup. _lock()#L380:When tokens are unlocked, users can withdraw the same quantity of tokens from the contract. unlock()#L423:
However, as the contract receives less tokens than the provided
_quantity
due to the transfer fee, the contract would not have sufficient tokens for withdrawal, leading to users cannot unlock their tokens.Tools Used
vscode
Recommended Mitigation Steps
Consider implement the support for fee-on-transfer tokens.
Assessed type
ERC20