# Incompatability with deflationary / fee-on-transfer tokens

Harpie Vault logged the requested transfer amount instead of the actual received amount for fee-on-transfer ERC20s, letting early withdrawers drain funds and later users' withdrawals fail.

- Payout: Contest reward
- Severity: medium
- Program: Harpie
- Credited: Lambda
- Disclosed: 2022-09-16
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2022-09-harpie-judging/tree/main/005-M
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-09-harpie%3AM-3
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** ERC20 vault deposit/withdraw accounting (Transfer.sol)
**Root cause:** transferERC20() calls logIncomingERC20() with the pre-transfer amount passed to safeTransferFrom(), but fee-on-transfer tokens deliver less than that amount to the Vault, so recorded balances exceed actual holdings.
**Steps:**
1. Token X charges 10% fee per transfer; Alice holds 1000, Bob 2000.
2. Harpie seizes both balances into Vault; logIncomingERC20 records 1000 and 2000, but Vault only receives 2700.
3. Bob withdraws with amountStored=2000; Vault sends 2000, Bob receives 1800, Vault left with 700.
4. Alice's 1000 withdrawal now fails due to insufficient Vault balance.
**How found:** Code review of Transfer.transferERC20() noticing logIncomingERC20() is passed the requested amount rather than a measured balance delta, combined with knowledge of fee-on-transfer token semantics.
**Exploitation:** Any user whose tokens are seized and later withdrawn can withdraw the full recorded amount while the Vault only holds the post-fee amount, shifting the fee loss onto other depositors and eventually blocking their withdrawals.
**Insight:** Whenever a contract records deposits by the amount argument rather than a before/after balance delta, fee-on-transfer and rebasing tokens desynchronize accounting from actual holdings; check every logIncoming/deposit path for balance-delta measurement.