Tadle

Tadle
DeFi
30,000 USDC
View results
Submission Details
Severity: low
Valid

Incorrect Tax validation

Summary

Wrong validation of the eachTradeTax parameter. While the impact is low, it could lead to confusion or unintended behavior if not addressed.

Vulnerability Details

The current implementation inside PreMarkets.sol, checks whether the eachTradeTax is greater than the maximum allowable value defined by Constants.EACH_TRADE_TAX_DECIMAL_SCALER.

However, the validation logic should ensure that the eachTradeTax is less than or equal to the maximum, as specified by the @dev comment.

// '@dev eachTradeTax must be less than 100%' means it needs to be >=
if (params.eachTradeTax > Constants.EACH_TRADE_TAX_DECIMAL_SCALER) {
revert InvalidEachTradeTaxRate();
}

This check currently prevents values greater than the maximum but does not allow values equal to it, which could be a valid scenario. The contract should instead permit eachTradeTax values up to and including the maximum defined by the constant.

Impact

Users may experience unnecessary transaction failures when setting eachTradeTax to the maximum allowable value, resulting in a poor user experience. Additionally, the current logic doesn't match the intended behavior outlined in the documentation, potentially causing confusion for developers.

Tools Used

Imagination

Recommendations

To align the contract's behavior with the documented intent, the validation should be updated to allow eachTradeTax values that are less than or equal to the maximum:

+ if (params.eachTradeTax >= Constants.EACH_TRADE_TAX_DECIMAL_SCALER) {
revert InvalidEachTradeTaxRate();
}
Updates

Lead Judging Commences

0xnevi Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-PreMarkets-off-by-one-Trade-TAX-100%

Similar to issue #1323, Despite this off-by-one error of the intended check, the difference between 99% and 100% is minimal, so I believe whether or not 100% is allowed has minimal impact. Ultimately, takers should not be realistically creating offer with such tradeTax

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.