Skip to content

Latest commit

 

History

History
52 lines (43 loc) · 2.25 KB

010.md

File metadata and controls

52 lines (43 loc) · 2.25 KB
Raw

Bauer

medium

Insufficient support for fee-on-transfer tokens

Summary

The protocol do not support fee-on-transfer tokens. If collateral token is a fee-on-transfer token, tokens received from users could be less than the amount specified in the transfer.

Vulnerability Detail

The _deposit() function in CollateralManager.sol receives tokens from borrower with amount collateralInfo._amount . If collateral token is a fee-on-transfer token then the actual amount received by CollateralManager.sol is less than collateralInfo._amount.Inside the function, when calling collateralEscrow.depositAsset to deposit the token to escrow contract, the amount in the function parameter is also collateralInfo._amount, so the transaction may fail or be deposited to escrow contract with the funds from the CollateralManager protocol.

function _deposit(uint256 _bidId, Collateral memory collateralInfo)
        internal
        virtual
    {
        require(collateralInfo._amount > 0, "Collateral not validated");
        (address escrowAddress, address borrower) = _deployEscrow(_bidId);
        ICollateralEscrowV1 collateralEscrow = ICollateralEscrowV1(
            escrowAddress
        );
        // Pull collateral from borrower & deposit into escrow
        if (collateralInfo._collateralType == CollateralType.ERC20) {
            IERC20Upgradeable(collateralInfo._collateralAddress).transferFrom(
                borrower,
                address(this),
                collateralInfo._amount
            );
            IERC20Upgradeable(collateralInfo._collateralAddress).approve(
                escrowAddress,
                collateralInfo._amount
            );
            collateralEscrow.depositAsset(
                CollateralType.ERC20,
                collateralInfo._collateralAddress,
                collateralInfo._amount,
                0
            );

Impact

The protocol could suffer a loss of funds.

Code Snippet

https://github.com/sherlock-audit/2023-03-teller/blob/main/teller-protocol-v2/packages/contracts/contracts/CollateralManager.sol#L327-L341

Tool used

Manual Review

Recommendation

Consider checking the balance of the contract before and after token transfers and using instead of the amount specified in the contract.