The Standard
The Standard
DeFiHardhat
20,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Manager can grief with fees

saaj

Summary

The fees in LiquidationPoolManager can be set arbitrarily high or no fee at all as their exists no restriction in setPoolFeePercentage.

Vulnerability Details

setPoolFeePercentage does not have any check to prevent setting zero value or 100% fee for the protocol which can lead to loss for protocol and user in either case.

Impact

The owner can set a huge fee for example 100% for liquidity provider so that a user will get nothing in return or set the zero value in which pool get nothing and cause loss to protocol and user in above considered scenario.

Tools Used

Manual review

Recommendations

The recommendation is made to have check in function to prevent setting value to zero as well as have a max fee limit i.e.; 5% when fees are set for pool.

function setPoolFeePercentage(uint32 _poolFeePercentage) external onlyOwner {
+ require(_poolFeePercentage <= 5, “fee is too high”);
+ require(_poolFeePercentage != 0, “fee cannot be zero”);
poolFeePercentage = _poolFeePercentage;
}
Updates

Lead Judging Commences

hrishibhat Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Known issue
Assigned finding tags:

informational/invalid

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.