The Standard
The Standard
DeFiHardhat
20,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Unpredictable mint fee rate

sovaslava

Summary

The user does not know the exact amount of the commission

Vulnerability Details

When user want mint tokens in own vault, he call SmartVaultV3.mint(), and this function calculate fee.

uint256 fee = _amount * ISmartVaultManagerV3(manager).mintFeeRate() / ISmartVaultManagerV3(manager).HUNDRED_PC();

As we can see, function call SmartVaultManagerV3.mintFeeRate() function.
Function mintFeeRate return value, which could be changed by owner of project in any moment. Even, while users'tx in mempool.

// SmartVaultManagerV3
function setMintFeeRate(uint256 _rate) external onlyOwner {
mintFeeRate = _rate;
}
​

Impact

User could not predict amount of his debt - how many tokens will be minted.

Tools Used

Manual review

Recommendations

Store in immutable variable value of minting fee. and if function mintFeeRate return value greater than stored value, use stored value, if less, use received value.

Updates

Lead Judging Commences

hrishibhat Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Known issue
Assigned finding tags:

informational/invalid

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.