OpenZeppelin / OpenZeppelin/openzeppelin-contracts
ERC4626 does not check the amount of tokens received during the deposit
Nobody has claimed this yet.
- Dominant language
- Solidity
- Stars
- 27.2k
- Forks
- 12.4k
- Avg merge
- 2d 19h
- Merged PRs (30d)
- 33
Description
📝 Details
The deposit method assumes that as a result of transferFrom, the pool will receive exactly the number of tokens it expects.
However, there are implementations of tokens that may violate this assumption (for example, tokens with transfer fees). In this case, the vault may end up in an inconsistent state.
If this is expected behavior, based on the ERC20 standard, for example, then it might be worth mentioning such requirements for underlying assets?
Similar situation in ERC20Wrapper.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by inspecting the deposit method at the referenced lines in contracts/token/ERC20/extensions/ERC4626.sol, then compare the similar situation in ERC20Wrapper. Determine from the existing behavior and ERC20 assumptions whether fee-on-transfer assets require changed accounting or explicit documentation; done means the expected handling is decided and consistently addressed.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- solidity
- Domain
- blockchain, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100