# Incorrect accounting on transfer-on-fee/deflationary tokens in Gravity

Gravity's sendToCosmos emits the requested _amount rather than the actually received amount, so deflationary/fee-on-transfer deposits mint excess Cosmos vouchers that can drain other depositors' tokens.

- Payout: Audit contest
- Severity: medium
- Program: Althea Gravity Bridge
- Found by: shw
- Disclosed: 2021-08-19
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-08-gravitybridge-findings/issues/62
- Library page: https://bugbountylibrary.com/r/c4%3A2021-08-gravitybridge%3AM-04
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** Gravity.sol sendToCosmos bridge deposit function
**Root cause:** sendToCosmos uses the caller-supplied _amount in SendToCosmosEvent instead of measuring the actual balance delta from transferFrom, so fee-on-transfer/deflationary tokens credit more than was locked.
**Steps:**
1. Deposit a deflationary/fee-on-transfer token via `sendToCosmos(_tokenContract, _destination, _amount, _nonce)`; transferFrom delivers less than `_amount` to the bridge.
2. Observe the emitted `SendToCosmosEvent` still records `_amount`.
3. Cosmos side mints vouchers for `_amount`, exceeding the tokens actually locked.
4. Withdraw the inflated vouchers to take tokens deposited by other users.
**How found:** Code review of sendToCosmos noting the event uses the input _amount rather than a balanceOf delta, combined with knowledge that fee-on-transfer tokens deliver less than requested.
**Exploitation:** Attacker deposits a fee-on-transfer token, receives vouchers for the full nominal amount, then withdraws more than deposited, draining tokens other users locked in the bridge.
**Insight:** For any bridge/vault that credits on deposit, check whether the credited amount is the requested amount or a measured balanceOf delta; fee-on-transfer and rebasing tokens break the former.