# Incompatibility with fee-on-transfer/inflationary/deflationary/rebasing tokens, on both base tokens and quote tokens, with varying impacts

SizeSealed assumes exact ERC20 transfer amounts; fee-on-transfer/rebasing base or quote tokens cause reverts, locked funds, or DoS on withdrawals.

- Payout: Contest reward
- Severity: medium
- Program: SIZE
- Credited: neko\_nyaa
- Disclosed: 2023-01-09
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-11-size-findings/issues/47
- Library page: https://bugbountylibrary.com/r/c4%3A2022-11-size%3AM-01
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity vuln:accounting-error vuln:dos

**Target:** SizeSealed auction contract (Solidity, ERC20 transfers)
**Root cause:** Base token pull checks exact balance delta and reverts on fee-on-transfer; quote token pull stores the requested quoteAmount in state without verifying actual received amount, so later outgoing transfers rely on inflated stored values.
**Steps:**
1. Alice creates auction with rebasing base token (e.g. Aave aToken) and totalBaseAmount.
2. Bob bids 1e18 quote tokens that are fee-on-transfer; contract receives 1e18 - fee but stores quoteAmount = 1e18.
3. Alice cancels auction and withdraws base tokens; rebasing interest remains locked.
4. Bob calls withdraw(); outgoing transfer of stored quoteAmount fails due to insufficient contract balance (DoS / stuck funds).
**How found:** Code review of SizeSealed.sol transfer handling: noted base token has a balance-delta check (lines 96-105) while quote token pull at line 163 lacks any such check and stores the parameter directly, then traced all outgoing transfers relying on stored quoteAmount.
**Exploitation:** No attacker profit path; impact is accidental fund lock/DoS when such tokens are used. Bidder must top up contract to recover refunds, incurring extra fees.
**Insight:** When auditing token-pull logic, compare every inbound transfer path for balance-delta verification; a check present on one token but absent on the other is a strong signal of inconsistent accounting that later outgoing transfers will inherit.