s0x0mtee - Risk of Fund Loss Due to Unexpected Withdrawals

[sherlock-admin2]

s0x0mtee

High

Risk of Fund Loss Due to Unexpected Withdrawals

Summary

In the provided contract, users risk losing funds due to an issue in the deposit function where the require statement relies on balance checks after transferring tokens. If another user or transaction initiates a withdrawal or reduces the contract’s balance before the balanceAfter is read, the balance difference may fall below the expected amount, causing the require statement to fail. This failure reverts the transaction and rolls back any state changes within the contract, but does not revert the external token transfer, as it is executed by the external ERC20 token contract. As a result, the tokens transferred into the contract during safeTransferFrom remain locked, leaving the sender unable to recover them unless a specific recovery mechanism exists.

https://github.com/sherlock-audit/2024-11-debita-finance-v3/blob/main/Debita-V3-Contracts/contracts/Non-Fungible-Receipts/TaxTokensReceipts/TaxTokensReceipt.sol#L59-L89

Root Cause

No response

Internal pre-conditions

No response

External pre-conditions

No response

Attack Path

No response

Impact

No response

PoC

No response

Mitigation

No response