# `LenderCommitmentGroup` pools will have incorrect exchange rate when fee-on-transfer tokens are used

LenderCommitmentGroup_Smart uses pre-transfer amount for share minting and accounting, inflating exchange rate with fee-on-transfer tokens.

- Payout: Contest reward
- Severity: medium
- Program: Teller
- Credited: 0x73696d616f
- Disclosed: 2024-04-18
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-04-teller-finance-judging/issues/122
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-04-teller-finance%3AM-9
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:precision-loss

**Target:** LenderCommitmentGroup_Smart contract
**Root cause:** addPrincipalToCommitmentGroup credits the full _amount to totalPrincipalTokensCommitted and mints shares based on _amount, ignoring the actual received amount after fee-on-transfer deduction.
**Steps:**
1. Deploy or use a pool with a fee-on-transfer principal token.
2. Call `addPrincipalToCommitmentGroup(_amount, sharesRecipient)` with a fee-on-transfer token.
3. Observe `principalToken.transferFrom` delivers less than `_amount` to the contract.
4. Contract still adds `_amount` to `totalPrincipalTokensCommitted` and mints shares via `_valueOfUnderlying(_amount, sharesExchangeRate())`.
5. `getPoolTotalEstimatedValue` becomes inflated, skewing `sharesExchangeRate`.
**How found:** Code review of deposit flow: noticed transferFrom return value ignored and _amount used for both accounting and share minting, then reasoned about fee-on-transfer token behavior.
**Exploitation:** Deposit fee-on-transfer tokens repeatedly; each deposit inflates totalPrincipalTokensCommitted relative to actual balance, raising the exchange rate and diluting existing shareholders or over-crediting the depositor on later withdrawals.
**Insight:** When auditing vault/share contracts, check whether deposit accounting uses the requested amount or the actual balance delta; fee-on-transfer and rebasing tokens break naive accounting even if the protocol claims Uniswap V3 compatibility, since only the router rejects such tokens.