Tadle

Tadle
DeFiFoundry
27,750 USDC
View results
Submission Details
Severity: low
Valid

`makerInfo.platformFee` can't be claimed forever.

Summary

There is no logic to claim makerInfo.platformFee.

Vulnerability Details

In createTaker(), it calculates remainingPlatformFee after subtracting referral bonues.

File: PreMarkets.sol
254: uint256 remainingPlatformFee = _updateReferralBonus(
255: platformFee,
256: depositAmount,
257: stockAddr,
258: makerInfo,
259: referralInfo,
260: tokenManager
261: );
262:
263: makerInfo.platformFee = makerInfo.platformFee + remainingPlatformFee; //@audit claim?

But there is no mechanism to claim this accrued makerInfo.platformFee.

Impact

Possible fund lock in the protocol.

Tools Used

Manual Review

Recommendations

There should be a logic to claim the makerInfo.platformFee.

Updates

Lead Judging Commences

0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-PreMarkets-platformFee-no-withdraw-functionality

Low severity, this can be done using the `Rescuable.sol` contract. Arguably there is no errors here given the `platformFee` variable can represent the historical fees that the protocol has accumulated and need not be updated when fees are withdrawn. However, I believe a more explicit function can be valuable to be more transparent regarding withdrawals. However, I will leave this issue open for escalation for debates because I can see it as arguably invalid as well, but I see no arguments for it being medium severity since there is an alternative to retrieve platform fees, assuming admins are trusted.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.