UVToken-Audit 2

When transferring deflationary ERC20 tokens, the input amount may not be equal to the received amount due to the charged transaction fee. For example, if a user sends 100 deflationary tokens (with a 10% transaction fee), only 90 tokens actually arrived to the contract. However, a failure to discount such fees may allow the same user to withdraw 100 tokens from the contract, which causes the contract to lose 10 tokens in such a transaction. ```solidity=427 payToken(tokenAddress_, _userAddr, _pledgeAmount); ``` - Transferring tokens by `_pledgeAmount`. - This function call executes the following operation. ```solidity=429 IPledge_.insertUVTPledge(_userAddr, _pledgeAmount); ``` - The `_pledgeAmount` appears to be used for bookkeeping purposes without compensating the potential transfer fees.

There should always be events emitted in the sensitive functions that are controlled by centralization roles.

The contract is serving as the underlying entity to interact with one or more out-of-scope dependencies. The scope of the audit treats out-of-scope entities as black boxes and assume their functional correctness. ```solidity=277 IFinance public IFinance_; ``` - The contract `UVTPledge` interacts with out-of-scope contract with `IFinance` interface via `IFinance_`. --- ```solidity=279 IERC20 public tokenAddress_; ``` - The contract `UVTPledge` interacts with out-of-scope contract with `IERC20` interface via `tokenAddress_`. --- ```solidity=324 function createPledge(IPledge _IPledge, bool _isValid) external authorised ``` - The contract `UVTPledge` interacts with out-of-scope contract with `IPledge` interface via `_IPledge`.