# Fee on transfer tokens transfer less tokens than what is stored in the receipt on deposits Medium · Three Sigma · DeFi infrastructure · 10th November, 2023 Finding 3S-Clip Finance-M07 of the Clip Finance Strategies security review. - Protocol: https://www.clip.finance/ - Report: /reports/clip-finance-i - Source: https://cdn.sanity.io/files/qoqld077/production/c23d04c8223879d2443221caf3ccb55ac118441a.pdf --- ### Description Some tokens have a fee on transfer, such as USDT, although it is disabled currently [(line 127](https://etherscan.io/token/0xdac17f958d2ee523a2206206994597c13d831ec7#code) and 177). This means that on deposits, the actually deposited amount to the smart contract will not be the one passed as argument, but its value minus the fee. Thus, for example, the [`Batch.sol`](https://github.com/ClipFinance/strategy-router/blob/master/contracts/Batch.sol#L247) contract will hold less funds than stored, potentially leading to withdrawal failure. ### Recommendation The actual transferred amount is the balance after minus the balance before the transfer. Modify [this](https://github.com/ClipFinance/strategy-router/blob/master/contracts/StrategyRouter.sol#L491) line to: ```solidity uint256 previousBalance = IERC20(depositToken).balanceOf(address(batch)); IERC20(depositToken).safeTransferFrom(msg.sender, address(batch), depositAmount); depositAmount = IERC20(depositToken).balanceOf(address(batch)) previousBalance; ``` Also, place the lines above before calling batch.deposit(). ### Status Acknowledged --- Related findings: - [`Claimers` can receive less `feePerClaim` than they should if some prizes are already claimed or if reverts because of a reverting hook](https://0xsimao.com/findings/pooltogether-the-prize-layer-for-defi-claimers-fee-reverts-hook): PoolTogether Prize Layer - [Delegate rewards system is unfair to delegates with less tokens and reduces decentralization](https://0xsimao.com/findings/ajna-protocol-delegate-rewards-system-decentralization): Ajna Protocol - [Reusing the same rho and pubKey in different deposits leads to lost tokens](https://0xsimao.com/findings/singularity-reusing-rho-pub-deposits): Singularity - [BasicVault is incompatible with fee-on-transfer tokens](https://0xsimao.com/findings/mitosis-basic-incompatible-fee-transfer): Mitosis