Submission Details
Severity:
Withdrawal fee should not be set to 0
Summary
Withdrawal fee should not be set to 0.
Vulnerability Details
For Ditto to be profitable, withdrawal fee cannot be 0.
In the BridgeRouterFacet#withdraw function
fee = zethAmount.mulU88(withdrawalFee);
zethAmount -= fee;
s.vaultUser[vault][address(this)].ethEscrowed += fee;
When zethAmount is very small, the withdrawal fee might be 0. This means no withdrawal fee will be taken, and the escrowed value won't change.
Impact
Without collecting fees, Ditto won't earn profits. Also, users might exploit the function because it doesn't cost them anything.
Tools Used
Manual
Recommendations
Make sure withdrawal fee is always greater than 0.
Prize pool breakdown
Total prize
55,000 USDC
nSLOC
3,36516 USDC / LOC
50,000 USDC
5,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.