Non-standard ERC20 tokens are not supported
The protocol implemented a function `deposit()` to allow users to deposit.\\n```\\nDepositVault.sol\\n    function deposit(uint256 amount, address tokenAddress) public payable {\\n        require(amount > 0 || msg.value > 0, "Deposit amount must be greater than 0");\\n        if(msg.value > 0) {\\n            require(tokenAddress == address(0), "Token address must be 0x0 for ETH deposits");\\n            uint256 depositIndex = deposits.length;\\n            deposits.push(Deposit(payable(msg.sender), msg.value, tokenAddress));\\n            emit DepositMade(msg.sender, depositIndex, msg.value, tokenAddress);\\n        } else {\\n            require(tokenAddress != address(0), "Token address must not be 0x0 for token deposits");\\n            IERC20 token = IERC20(tokenAddress);\\n            token.safeTransferFrom(msg.sender, address(this), amount);\\n            uint256 depositIndex = deposits.length;\\n            deposits.push(Deposit(payable(msg.sender), amount, tokenAddress));//@audit-issue fee-on-transfer, rebalancing tokens will cause problems\\n            emit DepositMade(msg.sender, depositIndex, amount, tokenAddress);\\n        }\\n    }\\n```\\n\\nLooking at the line L49, we can see that the protocol assumes `amount` of tokens were transferred. But this does not hold true for some non-standard ERC20 tokens like fee-on-transfer tokens or rebalancing tokens. (Refer to here about the non-standard weird ERC20 tokens)\\nFor example, if token incurs fee on transfer, the actually transferred `amount` will be less than the provided parameter `amount` and the `deposits` will have a wrong state value. Because the current implementation only allows full withdrawal, this means the tokens will be locked in the contract permanently.
We recommend adding another field in the `Deposit` structure, say `balance`\\nWe recommend allow users to withdraw partially and decrease the `balance` field appropriately for successful withdrawals. If these changes are going to be made, we note that there are other parts that need changes. For example, the withdraw function would need to be updated so that it does not require the withdrawal amount is same to the original deposit amount.
If non-standard ERC20 tokens are used, the tokens could be locked in the contract permanently.
```\\nDepositVault.sol\\n    function deposit(uint256 amount, address tokenAddress) public payable {\\n        require(amount > 0 || msg.value > 0, "Deposit amount must be greater than 0");\\n        if(msg.value > 0) {\\n            require(tokenAddress == address(0), "Token address must be 0x0 for ETH deposits");\\n            uint256 depositIndex = deposits.length;\\n            deposits.push(Deposit(payable(msg.sender), msg.value, tokenAddress));\\n            emit DepositMade(msg.sender, depositIndex, msg.value, tokenAddress);\\n        } else {\\n            require(tokenAddress != address(0), "Token address must not be 0x0 for token deposits");\\n            IERC20 token = IERC20(tokenAddress);\\n            token.safeTransferFrom(msg.sender, address(this), amount);\\n            uint256 depositIndex = deposits.length;\\n            deposits.push(Deposit(payable(msg.sender), amount, tokenAddress));//@audit-issue fee-on-transfer, rebalancing tokens will cause problems\\n            emit DepositMade(msg.sender, depositIndex, amount, tokenAddress);\\n        }\\n    }\\n```\\n