Breeje - doCutDepositFee and doCutWithdrawFee doesn't take FEES ON TRANSFER TOKENS in account

[github-actions]

Breeje

medium

doCutDepositFee and doCutWithdrawFee doesn't take FEES ON TRANSFER TOKENS in account

Summary

Fees on transfer case not considered in couple of methods.

Vulnerability Detail

In BlueBerryBank, doCutDepositFee and doCutWithdrawFee methods transfers the fees but doesn't handle fees on transfer condition.

Impact

The passes value of deducting the fees can be incorrect.

Code Snippet

File: BlueBerryBank.sol

    function doCutDepositFee(address token, uint256 amount)
        internal
        returns (uint256)
    {
        if (config.treasury() == address(0)) revert NO_TREASURY_SET();
        uint256 fee = (amount * config.depositFee()) / DENOMINATOR;
        IERC20Upgradeable(token).safeTransfer(config.treasury(), fee);
        return amount - fee;
    }

    function doCutWithdrawFee(address token, uint256 amount)
        internal
        returns (uint256)
    {
        if (config.treasury() == address(0)) revert NO_TREASURY_SET();
        uint256 fee = (amount * config.withdrawFee()) / DENOMINATOR;
        IERC20Upgradeable(token).safeTransfer(config.treasury(), fee);
        return amount - fee;
    }

Link to code

Tool used

Manual Review

Recommendation

Recommend to check balance before and after transfer and return the value accordingly

Duplicate of #153