# Code credits fee-on-transfer tokens for amount stated, not amount transferred

Juicebox terminals credited the stated transfer amount rather than the received amount, so fee-on-transfer tokens left balances short and withdrawals reverted.

- Payout: Contest reward
- Severity: medium
- Program: Juicebox
- Credited: IllIllI
- Disclosed: 2022-10-11
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-07-juicebox-findings/issues/304
- Library page: https://bugbountylibrary.com/r/c4%3A2022-07-juicebox%3AM-06
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:dos

**Target:** JBSingleTokenPaymentTerminalStore / JBPayoutRedemptionPaymentTerminal (Solidity)
**Root cause:** pay() and addToBalanceOf() call _transferFrom for _amount and record that same _amount in the terminal store, ignoring the fee deducted by fee-on-transfer tokens, so stored balances exceed actual token holdings.
**Steps:**
1. Deploy/use a terminal whose token charges a fee on transfer (e.g. 10%).
2. Call `pay(_projectId, _amount, token, ...)`; `_transferFrom(msg.sender, address(this), _amount)` delivers `_amount*0.9` but `recordPaymentFrom` stores full `_amount`.
3. Repeat deposits so `balanceOf[terminal][projectId]` exceeds real balance.
4. Call distribution/withdrawal; `recordDistributionFor` subtracts stated `distributedAmount` and `_distributeToPayoutSplitsOf` transfers it, reverting on insufficient balance.
5. A whale withdrawing the last 10% drains remaining tokens, blocking other projects' withdrawals.
**How found:** Code review of the terminal store: noticed balanceOf is incremented by `_amount.value` from the caller rather than measured balance delta, and that terminals never consult actual token balance after transfer.
**Exploitation:** Any depositor using a fee-on-transfer token underfunds the terminal while the store credits full value; later distributions/withdrawals revert for the project (or a large withdrawer drains funds others were credited), causing denial of withdrawal.
**Insight:** When auditing vault/accounting contracts, check whether credited amounts come from caller-supplied values or measured balance deltas; any token with transfer fees, rebasing, or hooks breaks stated-amount accounting.