Submitted by IllIllI, also found by Aits, BowTiedWardens, and MaratCerby
If rewards are given in fee-on-transfer tokens, users may get no rewards, breaking functionality.
Med: Assets not at direct risk, but the function of the protocol or its availability could be impacted, or :::leak value with a hypothetical attack path with stated assumptions:::, but external requirements.
(emphasis mine)
The underlying BAL protocol support fee-on-transfer tokens, so should Aura.
ExtraRewardsDistributor.sol#L87-L98
If a fee is charged the total amount available to be transferred later will be less than the _amount passed in.
Consider the following scenario:
User A holds 98% of the total supply of vlBAL (the system is being bootstrapped)
User B holds 1%
User C holds 1%
ExtraRewardsDistributor.sol#L87-L98
Measure the contract balance before and after the transfer, and use the difference as the amount, rather than the stated amount.
0xMaharishi (Aura Finance) disputed and commented:
LSDan (judge) commented:
