Tadle

Summary

In certain scenarios, a Maker can bypass paying platform fees. The issue arises in the createTaker() function, where the fee is taken from the Maker. If a Taker buys only a portion of the offer (e.g., half), the platform fee becomes zero due to rounding, effectively allowing the Maker to avoid paying fees for that portion.

Vulnerability Details

Suppose Alice creates an offer to sell 100 Points for $20. Bob, who wants to buy half of that offer (i.e., 50 Points for $10), will call createTaker(address _offer, uint256 _points).

How this happens 👇

Step 1: Find the platformFeeRate

The platformFeeRate is 0.5%, as stated in this reference.

Step 2: Calculate the DepositAmount

After calculation, the depositAmount is 10.

Step 3: Calculate platformFee

The final platformFee would be 0.05. However, since platformFee is a uint256 and cannot represent fractional numbers, it is rounded down to 0.

Step 4: Calculate remainingPlatformFee

Since platformFee = 0, the _updateReferralBonus() function sets both referrerReferralBonus and authorityReferralBonus to 0, resulting in a remainingPlatformFee of 0.

Step 5: Update makerInfo.platformFee

Because remainingPlatformFee is zero, and the platformFee was initially set to zero when creating the offer, the makerInfo.platformFee remains zero.

https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/PreMarkets.sol#L263

Impact

The rounding down of fractional platform fees to zero allows the Maker to avoid paying the required fee when a Taker buys a portion of the offer. This vulnerability could result in a loss of revenue for the platform and create an unfair advantage for Makers.

Tools Used

Manual Review

Recommendations

Set Minimum Fee Threshold: Introduce a minimum platform fee threshold, ensuring that even small transactions incur a fee that cannot be bypassed.