InsureDAO contest - pmerkleplant's results

Handle

pmerkleplant

Vulnerability details

Impact

There exist ERC20 tokens that charge a fee for every transfer.

This kind of token does not work correctly with the PoolTemplate::deposit function.

Proof of Concept

The PoolTemplate::deposit function mints an amount of iTokens based on the function's parameter _amount, see line 239.

However, in case the deposit token is a fee-on transfer token the amount of tokens the vault receives would be less than _amount and therefore the minting would be off.

Recommended Mitigation Steps

To disable depositing of fee-on transfer tokens, add the following code in Vault::addValue around line 136:

uint256 oldBalance = token.balanceOf(address(this));
IERC20(token).safeTransferFrom(_from, address(this), _amount);
uint256 newBalance = token.balanceOf(address(this));
require(oldBalance + _amount == newBalance);