Tokens with fee on transfer are not supported in TimeswapV2Option.sol

[code423n4]

Lines of code

https://github.com/code-423n4/2023-01-timeswap/tree/main/packages/v2-option/src/TimeswapV2Option.sol#L220
https://github.com/code-423n4/2023-01-timeswap/tree/main/packages/v2-option/src/TimeswapV2Option.sol#L259
https://github.com/code-423n4/2023-01-timeswap/tree/main/packages/v2-option/src/TimeswapV2Option.sol#L262

Vulnerability details

Some tokens take a transfer fee (e.g. STA, PAXG), some do not currently charge a fee but may do so in the future (e.g. USDT, USDC).

Should a fee-on-transfer token be used, it could be abused to mint more shares. In the current implementation, TimeswapV2Option.sol#swap() and TimeswapV2Option.sol#collect() assume that the received amount is the same as the transfer amount, and uses it to calculate funds. As a result, users will be unable to properly use the functionality of swap and collect functions due to how fee-on-transfer tokens work.

Proof Of Concept

220: IERC20(param.isLong0ToLong1 ? token0 : token1).safeTransfer(param.tokenTo, param.isLong0ToLong1 ? token0AndLong0Amount : token1AndLong1Amount);

https://github.com/code-423n4/2023-01-timeswap/tree/main/packages/v2-option/src/TimeswapV2Option.sol#L220

259: if (token0Amount != 0) IERC20(token0).safeTransfer(param.token0To, token0Amount);
262: if (token1Amount != 0) IERC20(token1).safeTransfer(param.token1To, token1Amount);

https://github.com/code-423n4/2023-01-timeswap/tree/main/packages/v2-option/src/TimeswapV2Option.sol#L259

https://github.com/code-423n4/2023-01-timeswap/tree/main/packages/v2-option/src/TimeswapV2Option.sol#L262

Recommended Mitigation Steps

• Consider comparing before and after balance to get the actual transferred amount.
• Alternatively, disallow tokens with fee-on-transfer mechanics to be added as reward tokens.

[c4-judge]

Picodes marked the issue as primary issue

[c4-sponsor]

vhawk19 marked the issue as sponsor disputed

[c4-sponsor]

vhawk19 marked the issue as sponsor acknowledged

[vhawk19]

This is currently not supported by design

[c4-judge]

Picodes marked issue #247 as primary and marked this issue as a duplicate of 247

[c4-judge]

Picodes marked the issue as satisfactory