Tadle
Tadle
DeFi
30,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

No mechanism to manage the `platformFee`

kupiasec

Github link

https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/PreMarkets.sol#L263

Summary

There is no mechanism to manage the accrued platformFee tokens and they are locked to the CapitalPool contract.

Vulnerability Details

In the PreMarkets.createTaker function, creator of taker order provides the platformFee from L834.

https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/PreMarkets.sol#L834

function _depositTokenWhenCreateTaker(
uint256 platformFee,
uint256 depositAmount,
uint256 tradeTax,
MakerInfo storage makerInfo,
OfferInfo storage offerInfo,
ITokenManager tokenManager
) internal {
uint256 transferAmount = OfferLibraries.getDepositAmount(
offerInfo.offerType,
offerInfo.collateralRate,
depositAmount,
false,
Math.Rounding.Ceil
);
​
transferAmount = transferAmount + platformFee + tradeTax;
​
tokenManager.tillIn{value: msg.value}(
_msgSender(),
makerInfo.tokenAddress,
L834: transferAmount,
false
);
}

And remainingPlatformFee is accrued to makerInfo.platformFee variable from L263

https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/PreMarkets.sol#L263

uint256 remainingPlatformFee = _updateReferralBonus(
platformFee,
depositAmount,
stockAddr,
makerInfo,
referralInfo,
tokenManager
);
L263: makerInfo.platformFee = makerInfo.platformFee + remainingPlatformFee;

But there is no mechanism to withdraw the makerInfo.platformFee amount of tokens from CapitalPool contract.

Impact

The makerInfo.platformFee amount of tokens are locked to CapitalPool contract forever.

Tools Used

Manual Review

Recommendations

It is recommended to add the mechanism to manage the makerInfo.platformFee amount of tokens.

Updates

Lead Judging Commences

0xnevi Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-PreMarkets-platformFee-no-withdraw-functionality

Low severity, this can be done using the `Rescuable.sol` contract. Arguably there is no errors here given the `platformFee` variable can represent the historical fees that the protocol has accumulated and need not be updated when fees are withdrawn. However, I believe a more explicit function can be valuable to be more transparent regarding withdrawals. However, I will leave this issue open for escalation for debates because I can see it as arguably invalid as well, but I see no arguments for it being medium severity since there is an alternative to retrieve platform fees, assuming admins are trusted.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.