Submission Details
Severity:
Missing amount verification in the getCalculatedFee function.
Summary
The variable amount is not conditionally checked for amount > 0 in the getCalculatedFee function, allowing the sender to obtain a fee of 0.
Vulnerability Details
function getCalculatedFee(IERC20 token, uint256 amount) public view returns (uint256 fee) {
//slither-disable-next-line divide-before-multiply
uint256 valueOfBorrowedToken = (amount * getPriceInWeth(address(token))) / s_feePrecision;
//slither-disable-next-line divide-before-multiply
fee = (valueOfBorrowedToken * s_flashLoanFee) / s_feePrecision;
}
If amount = 0 then valueOfBorrowedToken will = 0 => fee = 0.
Impact
The user will not incur any fees
Tools Used
Manual review
Recommendations
Add a condition require(amount > 0, "error")
function getCalculatedFee(IERC20 token, uint256 amount) public view returns (uint256 fee) {
require(amount > 0, "error");
Rewards breakdown
nSLOC
387This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.