stake.link

Summary

We have the potential for an owner to set fees exceeding a 100% threshold, effectively allowing them to expropriate funds during significant transactions.

Vulnerability Details

It's essential to enforce a cap on permissible fees.

A rogue owner might initially set the fee rate at zero.

However, when a substantial transfer value is detected in the mempool, the owner can drastically increase the rate to its peak, enabling a potential sandwich attack on an unsuspecting user.

Impact

This vulnerability can be severe for users interacting with the contract. If exploited, users could lose a significant portion, if not all, of the transferred value in fees.

Tools

Manual review

Recommendations

Implement a fee cap