073.md

Late Hotpink Dinosaur

Medium

Incorrect Rate Application for Fee-on-Transfer Tokens in Stablecoin Handler

Summary

Unprotected handling of tokens with dynamic/changeable fees will cause a direct loss of funds for the protocol as the received amount can be significantly less than expected when fees change during the transaction (either by admin or by token's own mechanisms).

Root Cause

In StablecoinHandler.sol:_stablecoinSwap() at https://github.com/sherlock-audit/2024-11-telcoin/blob/main/telcoin-audit/contracts/stablecoin/StablecoinHandler.sol#L144 there is no protection against dynamic fee changes during execution:

function _stablecoinSwap(address wallet, StablecoinSwap memory ss) internal {
    // Fee could change between verification and execution
    ERC20PermitUpgradeable(ss.origin).safeTransferFrom(
        wallet,
        ss.liquiditySafe,
        ss.oAmount
    );
    
    // Protocol always sends full target amount regardless of 
    // how much was actually received after dynamic fees
    if (isXYZ(ss.target)) {
        Stablecoin(ss.target).mintTo(ss.destination, ss.tAmount);
    }
}

Internal pre-conditions

No response

External pre-conditions

No response

Attack Path

Scenario 1: Admin-Controlled Token Fee Change

Transaction Setup: Input: 1000 USDT Initial Fee: 2%

What Happens:

1. Token admin front-runs to change transfer fee to 20%
2. User's swap executes:
   • Sends 1000 USDT
   • Protocol receives 800 USDT (20% fee)
   • Protocol sends 1000 target tokens Loss: 200 tokens per transaction

Scenario 2: Amount-Based Dynamic Fee

Token Setup:

• Fee increases with transfer size
• e.g., 2% for < 1000 tokens 5% for 1000-5000 tokens 10% for > 5000 tokens

What Happens:

1. User swaps 6000 tokens expecting ~5880 (2% fee)
2. Actually receives 5400 (10% fee due to size)
3. Protocol still sends 6000 target tokens Loss: 600 tokens for the transaction

Scenario 3: Time/State-Based Fee Changes

Token Setup:

• Fee varies based on network congestion
• or time of day
• or token liquidity levels

What Happens:

1. User initiates swap when fee is 2%
2. Transaction executes when conditions change fee to 8%
3. Protocol receives 92% but sends 100% Loss: Variable based on fee at execution time

Impact

The protocol suffers losses whenever fees change to be higher than expected, with loss magnitude proportional to:

1. Size of fee change
2. Transaction volume
3. Frequency of fee changes

PoC

No response

Mitigation

No response