Zaros Part 1
Zaros
DeFiFoundry
60,000 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Incorrect fees calculation

twicek

Summary

The PerpMarket.getOrderFeeUsd function incorrectly calculates fees by not dividing the feeBps by 10000, leading to incorrect fee calculations.

Vulnerability Details

getOrderFeeUsd incorrectly calculates the orderFeeUsd by not dividing the feeBps by 10000:

PerpMarket.sol#L199

orderFeeUsd = markPriceX18.mul(sizeDelta.abs().intoUD60x18()).mul(feeBps);

PerpMarket.sol#L213-L219

UD60x18 takerFee =
markPriceX18.mul(ud60x18(takerSize)).mul(ud60x18(self.configuration.orderFees.takerFee));
UD60x18 makerFee =
markPriceX18.mul(ud60x18(makerSize)).mul(ud60x18(self.configuration.orderFees.makerFee));
​
​
// output order fee
orderFeeUsd = takerFee.add(makerFee);

Impact

Fees will be incorrectly calculated which will lead to a loss for the user.

Tool used

Manual Review.

Recommendations

- orderFeeUsd = markPriceX18.mul(sizeDelta.abs().intoUD60x18()).mul(feeBps);
+ orderFeeUsd = markPriceX18.mul(sizeDelta.abs().intoUD60x18()).mul(feeBps).div(ud60x18(10000));
}
// special logic for trades that flip the skew; trader should receive:
// makerFee for portion of size that returns skew to 0
// takerFee for portion of size that flips skew in other direction
else {
// convert new skew abs(SD59x18) -> uint256
uint256 takerSize = newSkew.abs().intoUint256();
​
​
// abs( abs(orderSize) - abs(newSkew) ) -> uint256
uint256 makerSize = sizeDelta.abs().sub(sd59x18(int256(takerSize))).abs().intoUint256();
​
​
// calculate corresponding fees for maker and taker portions
// of this trade which flipped the skew
- UD60x18 takerFee = markPriceX18.mul(ud60x18(takerSize)).mul(ud60x18(self.configuration.orderFees.takerFee));
+ UD60x18 takerFee = markPriceX18.mul(ud60x18(takerSize)).mul(ud60x18(self.configuration.orderFees.takerFee)).div(ud60x18(10000));
- UD60x18 makerFee = markPriceX18.mul(ud60x18(makerSize)).mul(ud60x18(self.configuration.orderFees.makerFee));
+ UD60x18 makerFee = markPriceX18.mul(ud60x18(makerSize)).mul(ud60x18(self.configuration.orderFees.makerFee)).div(ud60x18(10000));
​
​
// output order fee
orderFeeUsd = takerFee.add(makerFee);
Updates

Lead Judging Commences

inallhonesty Lead Judge
10 months ago
inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.