Biconomy Hyphen 2.0 contest - shenwilly's results

Lines of code

https://github.com/code-423n4/2022-03-biconomy/blob/04751283f85c9fc94fb644ff2b489ec339cd9ffc/contracts/hyphen/LiquidityPool.sol#L165-L170 https://github.com/code-423n4/2022-03-biconomy/blob/04751283f85c9fc94fb644ff2b489ec339cd9ffc/contracts/hyphen/LiquidityProviders.sol#L273 https://github.com/code-423n4/2022-03-biconomy/blob/04751283f85c9fc94fb644ff2b489ec339cd9ffc/contracts/hyphen/LiquidityProviders.sol#L325

Vulnerability details

Impact

There are ERC20 tokens that charge fee for every transfers (most notably USDT, which has a toggleable fee).

LiquidityProviders.addTokenLiquidity(), LiquidityProviders.increaseTokenLiquidity(), and LiquidityPool.depositErc20() assume that the received amount will be the same as the transfer amount, while the the actual transferred amount will be lower, leading to inaccurate accounting.

In LiquidityProviders.sol this will lead to later users not being able to withdraw their deposits. In LiquidityPool.sol it will cause incorrect calculation of reward and fees.

Recommended Mitigation Steps

Consider using the difference before and after the transfer as the amount to be used for accounting.