Submitted by dd0x7e8, also found by 0xAadi, 0xgh0stcybers3c, Daniel526, deeney, djshan_eden, JCN, mxteem, Roger, and unnamed
https://github.com/code-423n4/2025-01-next-generation/blob/499cfa50a56126c0c3c6caa30808d79f82d31e34/contracts/Token.sol#L166
The EURFToken contract includes a transaction fee mechanism where a percentage of the transferred amount is deducted as a fee. This fee is deducted from the senders balance additionally. However, in the transferFrom function, which allows spender addresses to transfer tokens on behalf of the actual owner, the contract does not account for the fact that the total deducted amount (including fees) may exceed the approved allowance.
Specifically, if a user approves a spender to transfer 100 tokens, and the transaction fee is 10%, the spender will effectively cause the owner to lose 110 tokens (100 for the transfer and 10 for the fee); even though the allowance was only 100. This violates the ERC-20 standard, where the spender should only be able to transfer up to the approved amount.
The PoC built on Foundry framework to show that the decreased balance exceeds the approved allowance in transferFrom function.
Test result:
Modify transferFrom to ensure that the spenders allowance covers both the transfer amount and fees:  
With this update, Bob can only transfer 100 EURF if Alice explicitly approves at least 110 EURF, preventing unintended token loss.
0xsomeone (judge) commented:
aivarsb (Next Generation) commented:
