Lines of code

https://github.com/code-423n4/2024-05-munchables/blob/57dff486c3cd905f21b330c2157fe23da2a4807d/src/managers/LockManager.sol#L380 https://github.com/code-423n4/2024-05-munchables/blob/57dff486c3cd905f21b330c2157fe23da2a4807d/src/managers/LockManager.sol#L423

Vulnerability details

Impact

The project description states it supports fee on transfer ERC20 tokens, however, the contract does not handle this token properly, leading to constract insolvent.

Proof of Concept

The _lock() function tracks the quantity of tokens users lockup. _lock()#L380:

        lockedToken.quantity += _quantity;

When tokens are unlocked, users can withdraw the same quantity of tokens from the contract. unlock()#L423:

    token.transfer(msg.sender, _quantity);

However, as the contract receives less tokens than the provided _quantity due to the transfer fee, the contract would not have sufficient tokens for withdrawal, leading to users cannot unlock their tokens.

Tools Used

vscode

Recommended Mitigation Steps

Consider implement the support for fee-on-transfer tokens.

Assessed type

ERC20

code-423n4 / 2024-05-munchables-findings

Incompatible with fee-on-transfer tokens #513