eeyore - Fee on transfer tokens will break the deposit process

[sherlock-admin4]

eeyore

Medium

Fee on transfer tokens will break the deposit process

Summary

The project has mentioned that in the future, USDT might be used as an underlying token. Deposits are currently accounted for by the intended amount, not the actual amount transferred via the safeTransferFrom() function.

Vulnerability Detail

Example:

1. USDT updates its fee-on-transfer setting to 0.03%.
2. Alice deposits 10,000 USDT.
3. Alice's deposit is accounted for as 10,000 USDT, but in reality, only 9,997 USDT is transferred.

Impact

While this is a highly unlikely scenario, if USDT turn-on its fee or any other token with a fee-on-transfer mechanism is used in the future, the deposit() function will work incorrectly.

Code Snippet

https://github.com/sherlock-audit/2024-06-mellow/blob/main/mellow-lrt/src/Vault.sol#L328-L334

Tool used

Manual Review

Recommendation

Deposits should be accounted on the amount excluding the fee, i.e., the amount the contract actually receives. This can be done by subtracting the pre-contract balance from the post-contract balance.

Duplicate of #129