search

sherlock-audit / 2024-06-magicsea-judging

8 stars 5 forks source link

Real Sand Viper - The fundAndBribe function can not be used with tokens that have a fee on transfer #725

Closed sherlock-admin3 closed 4 months ago

sherlock-admin3 commented 4 months ago

Real Sand Viper

Low/Info

The fundAndBribe function can not be used with tokens that have a fee on transfer

Summary

The fundAndBribe function can not be used with tokens that have a fee on transfer.

Vulnerability Detail

The fundAndBribe function in the BribeReward contract does not work with tokens that have a fee on transfer. After transferring totalAmount to the contract, the _bribe function checks if the current balance of the contract is less than the total amount, which is true because tokens with a fee on transfer result in the contract receiving fewer tokens than transferred.

token.safeTransferFrom(msg.sender, address(this), totalAmount);

if (balance < totalAmount) revert BribeRewarder__InsufficientFunds();

The whole transaction will revert, and the contract will not be funded and bribed.

Impact

The fundAndBribe function can not be used with tokens that have a fee on transfer.

Tool used

https://github.com/sherlock-audit/2024-06-magicsea/blob/main/magicsea-staking/src/rewarders/BribeRewarder.sol#L111

Manual Review

Recommendation

Add support for fee on transfer tokens to the Bribe reward contract.

0xSmartContract commented 4 months ago

This issue was submitted as low/info.