Lack of support for Fee-on-transfer / rebase token. #287
Labels
2 (Med Risk)
Assets not at direct risk, but function/availability of the protocol could be impacted or leak value
bug
Something isn't working
duplicate-367
satisfactory
Finding meets requirement
Lines of code
https://github.com/debtdao/Line-of-Credit/blob/e8aa08b44f6132a5ed901f8daa231700c5afeb3a/contracts/modules/credit/LineOfCredit.sol#L223
https://github.com/debtdao/Line-of-Credit/blob/e8aa08b44f6132a5ed901f8daa231700c5afeb3a/contracts/modules/credit/LineOfCredit.sol#L447
Vulnerability details
Impact
If the two parties, lender and borrower agree to use a fee-on-transfe token or a rebase token, the accounting will not work in line of credit contract.
Proof of Concept
Some tokens take a transfer fee (e.g. STA, PAXG), some do not currently charge a fee but may do so in the future (e.g. USDT, USDC).
For example, if the fee-on-transfer token charge 1% of fee on each transfer, the borrower and lender agree on a credit term,
the borrower call:
the borrower transfer the 100 amount of token, but because 1% of the fee is charged, the smart contract received 99 amount of token.
but the internal accounting still use the original 100 amount of token
The borrower want to borrow 100 amount token as they agreed on the term but the contract does not have enough balance, but the borrower still need to pay the interest as if there is 100 amount of token.
Some tokens may make arbitrary balance modifications outside of transfers (e.g. Ampleforth style rebasing tokens, Compound style airdrops of governance tokens, mintable / burnable tokens).
In fact, chainlink price oracle support Ampleforth token related oracle:
AMPL / ETH and AMPL / USD
https://docs.chain.link/docs/data-feeds/price-feeds/addresses/#Ethereum%20Mainnet
this is the contract for AMPL / USD oracle.
https://etherscan.io/address/0xe20CA8D7546932360e37E9D72c1a47334af57706#readContract
let us say the borrower and lender agrees on the term on a rebase token, since the contract does not track the rebasing balance, the rebased amount would not be accessible for both lender and borrower.
Tools Used
Manual Review.
Recommended Mitigation Steps
We recommend the project use before and after balance check to confirm how much amount of token the contract received.
We recommend the contract track the balance change for rebasing token.
The text was updated successfully, but these errors were encountered: