---
id: 18
title: "Fee-on-Transfer Token Exploit"
severity: 7
category: crypto
---

### 18 — Fee-on-Transfer Token Exploit
**Severity: 7** | **Real: Various DeFi protocols, ERC-20 fee tokens**

Token deducts a fee on transfer — program credits the sent amount, not the received amount. Actual balance is less than recorded.

#### Verification Procedure

**Step 1: Check if program handles any tokens besides SOL/WSOL**
```
grep -rn --include="*.rs" "remaining_accounts\|token_mint\|new.*mint" programs/*/src/instructions/
```
- If program only handles SOL/WSOL: N/A (SOL has no transfer fee)
- If program handles arbitrary SPL tokens: proceed

**Step 2: Check for post-transfer balance verification**
```
grep -rn --include="*.rs" -B5 -A10 "transfer" programs/*/src/instructions/ | grep -iE "balance.*before\|balance.*after\|pre_balance\|post_balance"
```
- ✅ PASS: Code snapshots balance before transfer, checks actual balance after, credits the difference
- ❌ FAIL: Credits the transfer amount parameter without verifying received amount

**Step 3: Check for Token-2022 transfer fee extension awareness**
```
grep -rn --include="*.rs" "transfer_fee\|TransferFee\|transfer_checked" programs/
```
- ✅ PASS: Uses `transfer_checked` which accounts for fees, or explicitly handles the fee extension
- ❌ FAIL: Uses basic `transfer` without fee awareness

**Step 4: Check allowlist for accepted tokens**
```
grep -rn --include="*.rs" -iE "allowed.*mint\|whitelist\|accepted_token\|supported.*token" programs/
```
- ✅ PASS: Program only accepts known tokens (e.g., WSOL, USDC) that don't have transfer fees
- ⚠️ PARTIAL: No explicit allowlist, but fee tokens are unlikely
- ❌ FAIL: Accepts any token without fee handling

**Overall verdict:**
- ✅: Post-transfer balance check, or only accepts known non-fee tokens, or uses transfer_checked
- ⚠️: Only handles known tokens but without explicit allowlist
- ❌: Credits transfer amount without verifying received, accepts arbitrary tokens