Submission Details
Severity:
Burn fees
Summary
Vulnerability Details
When burning EUROs, users have to pay the fee:
function burn(uint256 _amount) external ifMinted(_amount) {
uint256 fee = _amount * ISmartVaultManagerV3(manager).burnFeeRate() / ISmartVaultManagerV3(manager).HUNDRED_PC();
minted = minted - _amount;
EUROs.burn(msg.sender, _amount);
IERC20(address(EUROs)).safeTransferFrom(msg.sender, ISmartVaultManagerV3(manager).protocol(), fee);
emit EUROsBurned(_amount, fee);
}
It burns the specified amount and additionally transfers the fee, so the total amount required from the user is _amount + fee. Problems:
ifMinteddoes not account for the fee.users have to pay the fee on top of the amount. it would make more sense to burn
_amount - feeand then transfer the fee.
Impact
More tokens than specified will be transferred from the user. Based on my understanding, it is not intuitive.
Tools Used
Manual review
Recommendations
EUROs.burn(msg.sender, _amount - fee);
Updates
Lead Judging Commences
hrishibhat over 1 year ago
Submission Judgement Published Reason: Design choice
Assigned finding tags:
fee-loss
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
60933 USDC / LOC
17,500 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.