search

hats-finance / Most--Aleph-Zero-Bridge-0xab7c1d45ae21e7133574746b2985c58e0ae2e61d

Aleph Zero bridge to Ethereum
Apache License 2.0
0 stars 1 forks source link

rebasing Tokens Incompatible with `eth::most` #36

Open hats-bug-reporter[bot] opened 5 months ago

hats-bug-reporter[bot] commented 5 months ago

Github username: @0xmahdirostami Twitter username: 0xmahdirostami Submission hash (on-chain): 0x50953045c30f195c5375bc5a6412ee2f607181b7061901ec0dc478d3d2e77120 Severity: minor

Description: Description
Some tokens have rebasing mechanisms, which means their balance changes over time. This inconsistency can cause issues when users attempt to unlock tokens later on, as the balance may have changed since the initial transfer.

Impact
There is a denial-of-service (DoS) vulnerability in the sendRequestNative function due to the inconsistency in token balances. However, this issue is recoverable by the owner.

Scenario
User A locks some tokens with a rebasing mechanism in the contract, initially transferring 1e18 tokens. After some time passes, the balance of the token changes to 0.5e18 due to the rebasing mechanism. When the user attempts to unlock the tokens, the sendRequestNative function reverts because the balance no longer matches the initial transfer.

krzysztofziobro commented 4 months ago

The protocol is not intended to support any tokens with non-standard indirect balance changes. Whitelisting such a token would be considered an owner error.