# ERC-20 allowance bypass: spender can force sender to pay extra fees beyond approved amount

EURFToken.transferFrom deducts a transfer fee from the sender on top of the amount, letting a spender drain more than the approved allowance.

- Payout: Contest reward
- Severity: medium
- Program: Next Generation
- Credited: dd0x7e8
- Disclosed: 2025-05-12
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2025-01-next-generation#m-01
- Library page: https://bugbountylibrary.com/r/c4%3A2025-01-next-generation%3AM-01
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** EURFToken ERC-20 contract transferFrom
**Root cause:** transferSanity calls _payTxFee(sender, amount) which deducts the fee from the sender's balance before super.transferFrom, without checking that allowance covers amount+fee.
**Steps:**
1. Deploy EURFToken with _txfeeRate > 0 (e.g. 10%).
2. Alice calls `token.approve(spender, 100e6)`.
3. Spender calls `token.transferFrom(alice, bob, 100e6)`.
4. Observe alice balance decreases by 100e6 + fee, exceeding the 100e6 allowance.
**How found:** Code reading of transferFrom override noting transferSanity/_payTxFee deducts fees from sender before the standard allowance check in super.transferFrom.
**Exploitation:** A malicious approved spender transfers the full allowance; the fee is charged additionally to the owner, so the owner loses more than approved.
**Insight:** When a token overrides transferFrom to add hooks (fees, rebasing) before calling super, check whether those hooks move funds outside the allowance accounting; fee-on-top designs break ERC-20 spender guarantees.