Submitted by WatchPug
There are ERC20 tokens that charge fee for every transfer() or transferFrom(), E.g Vader token.
In the current implementation, BasePoolV2.sol#mint() assumes that the received amount is the same as the transfer amount, and uses it to calculate liquidity units.
https://github.com/code-423n4/2021-11-vader/blob/429970427b4dc65e37808d7116b9de27e395ce0c/contracts/dex-v2/pool/BasePoolV2.sol#L168-L229
Consider calling balanceOf() to get the actual balances.
SamSteinGG (Vader) disagreed with severity:
alcueca (judge) commented:
SamSteinGG (Vader) commented:
