Derify Protocol

When transferring deflationary ERC20 tokens, the input amount may not be equal to the received amount due to the charged transaction fee. For example, if a user sends 100 deflationary tokens (with a 10% transaction fee), only 90 tokens actually arrived to the contract. However, a failure to discount such fees may allow the same user to withdraw 100 tokens from the contract, which causes the contract to lose 10 tokens in such a transaction. Reference: https://thoreum-finance.medium.com/what-exploit-happened-today-for-gocerberus-and-garuda-also-for-lokum-ybear-piggy-caramelswap-3943ee23a39f ```solidity=81 require(IERC20(token).transferFrom(msg.sender, address(this), amount), "CVV_LT: TOKEN_TRANSFER_ERR"); ``` - Transferring tokens by `amount`. ```solidity=79 totalVestingAmount = totalVestingAmount + amount; ``` - The `amount` appears to be used for bookkeeping purposes without compensating the potential transfer fees. --- ```solidity=82 require(IERC20(token).transferFrom(msg.sender, address(this), amount), "PVV_LT: TOKEN_TRANSFER_ERR"); ``` - Transferring tokens by `amount`. ```solidity=80 totalVestingAmount = totalVestingAmount + amount; ``` - The `amount` appears to be used for bookkeeping purposes without compensating the potential transfer fees. --- ```solidity=81 require(IERC20(token).transferFrom(msg.sender, address(this), amount), "TVV_LT: TOKEN_TRANSFER_ERR"); ``` - Transferring tokens by `amount`. ```solidity=79 totalVestingAmount = totalVestingAmount + amount; ``` - The `amount` appears to be used for bookkeeping purposes without compensating the potential transfer fees.

The following functions are declared as `public`, contain array function arguments, and are not invoked in any of the contracts contained within the project's scope. The functions that are never called internally within the contract should have external visibility.

Functions that affect the status of sensitive variables should be able to emit events as notifications to customers.

The contract has unlocked compiler version. An unlocked compiler version in the source code of the contract permits the user to compile it at or above a particular version. This, in turn, leads to differences in the generated bytecode between compilations due to different compiler versions. This can lead to an ambiguity when debugging as compiler specific bugs may occur in the codebase that would be hard to identify over a span of multiple compiler versions rather than a specific one.

The linked variables could be declared as `constant` since these state variables are never modified.