Filmio

When transferring deflationary ERC20 tokens, the input amount may not be equal to the received amount due to the charged transaction fee. For example, if a user sends 100 deflationary tokens (with a 10% transaction fee), only 90 tokens actually arrived to the contract. However, a failure to discount such fees may allow the same user to withdraw 100 tokens from the contract, which causes the contract to lose 10 tokens in such a transaction. Reference: https://thoreum-finance.medium.com/what-exploit-happened-today-for-gocerberus-and-garuda-also-for-lokum-ybear-piggy-caramelswap-3943ee23a39f ```solidity=164 tokenInterface.transferFrom(escrow_account, _msgSender(), quantity); ``` - Transferring tokens by `quantity`. ```solidity=195 totalStakes = totalStakes - quantity; ``` - The `quantity` appears to be used for bookkeeping purposes without compensating the potential transfer fees.