token

Check whether deposit functions assume the transferred amount equals the received amount. The secure pattern measures balanceOf before and after transferFrom and credits only the actual received difference, which protects against tokens like PAXG and STA that deduct fees.

ERC777 tokens trigger tokensToSend and tokensReceived hooks, while ERC721 and ERC1155 safeTransfer functions invoke onERC721Received and onERC1155Received callbacks. State updates after these transfers allow reentrancy, so follow the checks-effects-interactions pattern.

USDT does not return a boolean from transfer and transferFrom, so require statements checking the return value revert unexpectedly. Use OpenZeppelin SafeERC20 wrappers like safeTransferFrom to handle tokens with missing return values.

Protocols should track shares instead of absolute token amounts, since cached balances become stale when the token supply rebases. Convert deposited amounts to shares proportional to the current total balance and total shares.

Pattern matching identifies known token weirdness categories but cannot catch novel token behaviors or protocol-specific logic flaws. It covers documented cases like blacklist DoS and decimal precision errors but requires manual review for custom token implementations.