Skip to content

Latest commit

 

History

History
73 lines (47 loc) · 2.24 KB

088.md

File metadata and controls

73 lines (47 loc) · 2.24 KB
Raw

Late Hotpink Dinosaur

Medium

Fee-on-Transfer Token Loss in Stablecoin Swap Implementation Due to Avoidable Additional Transfer

Summary

An inefficient fee collection mechanism will cause excess fee-on-transfer losses for users as they must first transfer the fee amount to the wallet before the swap, when it could be deducted from the swap amount directly.

Root Cause

In StablecoinHandler.sol:_stablecoinSwap() at https://github.com/sherlock-audit/2024-11-telcoin/blob/main/telcoin-audit/contracts/stablecoin/StablecoinHandler.sol#L152 the stablecoin fee is collected via a separate transfer from the user via wallet. This is evident as the fee is transferred first, even before the swap is performed.

if (ss.stablecoinFeeCurrency != address(0) && ss.stablecoinFeeSafe != address(0)) {
    ERC20PermitUpgradeable(ss.stablecoinFeeCurrency).safeTransferFrom(
        wallet,
        ss.stablecoinFeeSafe,
        ss.feeAmount
    );
}

Instead of deducting it from the swap amount when the fee currency matches the target token.

Internal pre-conditions

No response

External pre-conditions

No response

Attack Path

Consider USDT with 1% fee on transfer:

User wants to swap 1000 USDe to USDT with 10 USDT telcoin swap fee Current flow: a. User must first transfer 10 USDT fee

  • User transfers 10.1 USDT to cover fee-on-transfer
  • After 1% fee, wallet receives 10 USDT
  • Send 10 USDT fee to safe.

b. Then swap executes

  • 1000 USDe is taken from user via wallet.
  • 1000 USDT is sent from liquiditySafe to destination. After 1% fee, destination receives 990 USDT. Net receive 990-10.1 (paid for fee)= 979.9.

What should happen: a. User provides 1000 USDe b. Single swap execution:

  • 1000 USDe taken from user
  • 1000 USDT sent from liquiditySafe
  • Send 10 USDT as fee to safe.
  • Remaining 990 to user. User receives 980.1 after transfer fee.

Please note transfer fee on wallet to safe remain in both the cases.

But overall user has a loss due to additional transfer required at the start for fee as well as same amount being returned to the user.

Impact

The users suffer an unnecessary loss due to an extra fee-on-transfer deduction on the fee amount

PoC

No response

Mitigation

No response