sechub
HomeServicesAssetsJobsFindingsTicketsGovCheck
Guest Mode. Click here to sign in and access all features

    Protocol does not support fee-on-transfer or rebasing tokens

    Holoride: DeFi Token

    Severity
    Medium
    Status
    Fixed
    Location(s)

    https://github.com/sub7security/holoride-defi/blob/0557444ec0b3a4df44e0cf6c9bcd8e06eaea63c4/contracts/Staking.sol#L213-L221

    Description

    If fee-on-transfer tokens or rebasing tokens are used, protocol may have missing rewards that are not accounted for, causing users to be unable to claim what they thought they are able to.

    For example, in the staking contract, when rewards are added, amount is added to availableRewards. This is the amount that is transferred, and not the post-fee amount that actually exist in the contract. This means that there is an over computation.

    Some of the more popular tokens that fall into these categories would be USDT, while currently do not have fee on transfer, its contract implementation allows fee to be taken on transfer. stETH would be a popular token example of rebasing token.

    Recommendation

    Holoride should be careful to not use tokens that are either fee-on-transfer or rebasing. Otherwise, if Holoride wants to support such tokens, changes to the implementation must be done.

    Comments
    No comments yet

    Protocol does not support fee-on-transfer or rebasing tokens

    Holoride: DeFi Token

    Severity
    Medium
    Status
    Fixed