Tadle

Tadle
DeFiFoundry
27,750 USDC
View results
Submission Details
Severity: high
Valid

Takers Are Overcharged in Fees and Trade Tax When Their Stock Order Is Partly Filled/Settled

Summary

Takers are overcharged in fees and trade tax when their stock orders are partially filled or settled, leading to a loss of funds for takers.

Vulnerability Details

When users call PreMarkets::createTaker, they are charged platform fees and a trade tax paid to the corresponding maker for creating offers. This is analogous to market makers providing liquidity in traditional order book exchanges, where traders create limit orders.
Platform fees and trade taxes are charged based on the amount of points traded, with the fees and trade tax being a percentage of the taker's order. The larger the order size, the larger the fees, making this issue more critical.

uint256 platformFee = depositAmount.mulDiv(
platformFeeRate,
Constants.PLATFORM_FEE_DECIMAL_SCALER
);
uint256 tradeTax = depositAmount.mulDiv(
makerInfo.eachTradeTax,
Constants.EACH_TRADE_TAX_DECIMAL_SCALER
);

The trade tax is intended to incentivize offer creation; however, there is no guarantee that these offers will be fully settled. When offers are partially settled, the protocol fails to refund the taker the portion of their trade tax that wasn't serviced. It's understandable not to refund the platform fee, as most of it goes to the protocol and it’s not directly their fault that the taker's used points are not fully settled. However, the trade tax is paid to the maker, but it is not refunded when the maker doesn’t fully hold up their end of the deal.

Note:
I am aware that the protocol sends all the Asker's tokens to the Bidder when they partially settle. However, as highlighted in my other submission, "Askers Loses All Their Collateral and Point Tokens When They Partially Settle Bidder," this is incorrectly implemented.

This finding is valid because settling makers have the option to partially settle their takers, but the protocol still lets them keep all the trade tax that has been paid to them, despite not fully servicing the taker.

Impact

Takers experience a loss of funds as the fees and trade tax they pay are overcharged, and they are not receiving the full service they paid for.

Tools Used

  • Manual

Recommendations

Refund the portion of the trade tax that corresponds to the unfilled portion of the taker's order.

Updates

Lead Judging Commences

0xnevi Lead Judge 12 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-PreMarkets-immediate-withdrawal-allow-maker-steal-funds

Valid high severity, given orginal offer makers are not a trusted entity to enforce a settlement. The trade tax set by the maker should be returned back to the takers to avoid abuse of abortion of ask offers to steal trade tax from takers. Note for appeals period: See issue #528 for additional details

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.