Yield whitelists a rebasing/deflationary/inflationary token to be used as collateral or underlying by accident. This leads to miscalculations between internal Cauldron accounting and the balances in the token contracts.
Yield protocol allows different tokens to be used as collateral or underlying. The Join and Pool contracts do not appear to support rebasing/deflationary/inflationary tokens whose balance changes during transfers or over time. The necessary checks include at least verifying the number of tokens transferred to contracts before and after the actual transfer to infer any fees/interest. These seem to be absent as seen in the _join() call of Join.sol or in Pool contracts. The impact will be miscalculations between internal Cauldron accounting and the balances in the token contracts.
Yield currently manages this by approving only certain tokens to be used as collateral or underlying. Therefore, this is not an issue now as long as the tokens are determined to not be of the concerned kinds. However, this will become an issue if user-supplied tokens are accepted without the existing vetting.
Recommend:
albertocuestacanada (Yield) acknowledged:
uivlis commented:
