# If the collateral is a fee-on-transfer token, repayment will be blocked

Fee-on-transfer collateral is recorded at full amount but escrow receives less, so repayment/withdrawal reverts, locking collateral and blocking liquidation.

- Payout: Contest reward
- Severity: medium
- Program: Teller
- Credited: 0x2e
- Disclosed: 2023-03-20
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-03-teller-judging/issues/91
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-03-teller%3AM-4
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:dos

**Target:** CollateralManager / CollateralEscrowV1 ERC20 collateral deposit and withdraw
**Root cause:** CollateralManager._deposit transfers collateral twice (borrower->manager, manager->escrow) but records the user-supplied _amount rather than the actual received balance; fee-on-transfer tokens leave escrow holding less than recorded.
**Steps:**
1. Borrower creates bid with fee-on-transfer ERC20 collateral of amount X.
2. Lender calls `TellerV2.lenderAcceptBid`; `CollateralManager._deposit` does `transferFrom(borrower, manager, X)` then `approve` and `depositAsset(..., X, 0)` causing a second transfer, each deducting fees.
3. Escrow records `_collateral._amount = X` but actual balance < X.
4. Borrower repays; `collateralManager.withdraw` -> `CollateralEscrowV1._withdrawCollateral` calls `transfer(recipient, X)` which reverts due to insufficient balance.
5. Liquidation via `TellerV2.liquidateLoanFull` also reverts, leaving collateral stuck.
**How found:** Reviewer reasoned about fee-on-transfer token semantics: double transfer in _deposit deducts fees twice while recorded amount uses user input, so escrow balance diverges from accounting.
**Exploitation:** No attacker profit path; borrower's own repayment and liquidation both revert, trapping collateral in escrow and potentially triggering liquidation of the loan.
**Insight:** When a protocol pulls collateral through an intermediate contract (two transfers), fee-on-transfer tokens lose value twice; always record actual received balance via before/after balance check, and check whether repay paths force collateral withdrawal.