You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The text was updated successfully, but these errors were encountered:
HardlyDifficult
added
bug
Something isn't working
duplicate
This issue or pull request already exists
2 (Med Risk)
Assets not at direct risk, but function/availability of the protocol could be impacted or leak value
labels
May 30, 2022
JeeberC4
added
invalid
This doesn't seem right
and removed
bug
Something isn't working
duplicate
This issue or pull request already exists
2 (Med Risk)
Assets not at direct risk, but function/availability of the protocol could be impacted or leak value
labels
Jun 6, 2022
From minhquanym in #95
Incompatability with deflationary / fee-on-transfer tokens
Function Cally.createVault function takes a tokenIdOrAmount parameter but this parameter is not the actual transferred amount for fee-on-transfer / deflationary (or other rebasing) tokens in case tokenType = ERC20
Impact
The actual deposited amount might be lower than the specified depositAmount of the function parameter.
And when users exercise or withdraw they not only receive less than expected amount but also take funds of other vaults with the same vault.token too, causes loss of funds.
Proof-of-concept
https://github.com/code-423n4/2022-05-cally/blob/1849f9ee12434038aa80753266ce6a2f2b082c59/contracts/src/Cally.sol#L200
https://github.com/code-423n4/2022-05-cally/blob/1849f9ee12434038aa80753266ce6a2f2b082c59/contracts/src/Cally.sol#L296
https://github.com/code-423n4/2022-05-cally/blob/1849f9ee12434038aa80753266ce6a2f2b082c59/contracts/src/Cally.sol#L345
Recommended Mitigation Steps
Transfer the tokens first and compare pre-/after token balances to compute the actual amount.
The text was updated successfully, but these errors were encountered: