# BasicVault is incompatible with fee-on-transfer tokens Crit/High · Three Sigma · Cross-chain liquidity layer 1 · 25th June, 2024 Finding 3S-Mitosis-M01 of the Mitosis security review. - Protocol: https://mitosis.org/ - Report: /reports/mitosis - Source: https://cdn.sanity.io/files/qoqld077/production/b6b3bd7bb47407d99e76abb7c6dc615c1db5018e.pdf --- ### Description The deposit and redeem [functions](https://github.com/hyperlane-xyz/hyperlane-monorepo/blob/0865c948c378253b462d7be4fa33cd6e3d504cf0/solidity/contracts/client/MailboxClient.sol#L95-L99) of the vault take an amount parameter and mint/burn the corresponding amounts assuming a 1:1 ratio. However, fee-on-transfer tokens charge a small fee on every transfer, disrupting the 1:1 ratio and causing issues with internal accounting. ### Recommendation Compute the balance before and after the transfer, then subtract them to get the actual amount transferred. Additionally, use the nonReentrant modifier to prevent reentrancy in ERC777 tokens. ### Status Acknowledged --- Related findings: - [Funding cap in `IDOPoolAbstract::_basicParticipationCheck()` is imprecise and can lead to excessive tokens sold](https://0xsimao.com/findings/blast-ido-pools-participation-imprecise-excessive-sold): Blast IDO Pools - [Fee on transfer tokens transfer less tokens than what is stored in the receipt on deposits](https://0xsimao.com/findings/clip-finance-i-fee-transfer-receipt-deposits): Clip Finance Strategies - [No support for fee on transfer tokens](https://0xsimao.com/findings/singularity-support-fee-transfer-tokens): Singularity - [`LenderCommitmentGroup` pools will have incorrect exchange rate when fee-on-transfer tokens are used](https://0xsimao.com/findings/teller-finance-pools-exchange-fee-transfer): Teller Finance