Timeswap contest - pavankv's results

Lines of code

https://github.com/code-423n4/2023-01-timeswap/blob/main/packages/v2-option/src/TimeswapV2Option.sol#L172

Vulnerability details

Impact

A transfer-on-fee token or a deflationary/rebasing token, causing the received amount to be less than the accounted amount. For instance, a deflationary tokens might charge a certain fee for every transfer() or transferFrom() / safeTransfer() or safeTransferFrom().

Summary :-

Situation 1 :- In swap() it just transfer to recipient. If any user try to deals with transfer-on-fee token it will charge fee on transfer. Like user try to swap 100 tokens deflationary tokens , opposite party will receive 99 but user thought like 100 sent and he also gets 100 transfer-on-fee tokens equal number of other tokens. In last checkEnough() just check whether transfered or not but some of tokens paid as fee-on transfer .

Situation 2 :- Same as in collect() also .

Proof of Concept

swap():- https://github.com/code-423n4/2023-01-timeswap/blob/main/packages/v2-option/src/TimeswapV2Option.sol#L220

collect() :- https://github.com/code-423n4/2023-01-timeswap/blob/main/packages/v2-option/src/TimeswapV2Option.sol#L259 https://github.com/code-423n4/2023-01-timeswap/blob/main/packages/v2-option/src/TimeswapV2Option.sol#L262

Tools Used

Manual View

Recommended Mitigation Steps

Maintain before and after balance while dealing with transfer-on-fee tokens .