[kaze-cow]

Adds a "Non-standard ERC-20 tokens" subsection to the core contracts Security / Known Issues section.

It states that the protocol assumes transfer/transferFrom move exactly the requested amount, and that tokens deviating from this (e.g. fee-on-transfer, rebasing) are unsupported and their behavior in orders and settlements is undefined. Links to the supported tokens page.

This was already known to be the case and vaguely explained in https://docs.cow.fi/cow-protocol/reference/core/tokens. The purpose of this PR is to make it more clear because we continue to get bug reports regarding the smart contract behavior and need to make sure this is clearly documented.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Oct 19, 2026 8:08am UTC

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 2d20ae45-c3fd-4ba2-b347-078b5b64ca09

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[fedgiac]

We don't assume ERC20, otherwise USDT wouldn't be tradable. 😛

I wouldn't say this is a "known security issue" but it's more something that limits the scope of what we consider a vulnerability, or "known behavior."

My suggestion would be to move this explanation to "supported tokens" and link to that if people report a related vulnerability.
Note that having this "vulnerability" here won't necessarily stop people from submitting a related report, what we want is just being able to dismiss these quickly with a link.

If you still think we should add it here, then we should restructure the document so that it makes it clear that we're listing things that aren't a vulnerability but that are often mistakenly reported.