Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Unbounded _platformFeeRate

aresaudits

Summary

Vulnerability Details

The updateUserPlatformFeeRate function is designed to update the platform fee rate for a specific user. However, there is a potential issue with the lack of an upper bound check on the _platformFeeRate parameter. This could lead to unintended behavior or potential vulnerabilities if an excessively high fee rate is set.

/**
* @notice Update base platform fee rate
* @param _accountAddress Account address
* @param _platformFeeRate Platform fee rate of user
* @notice Caller must be owner
*/
function updateUserPlatformFeeRate(
address _accountAddress,
uint256 _platformFeeRate
) external onlyOwner {
require(
_platformFeeRate <= Constants.PLATFORM_FEE_DECIMAL_SCALER,
"Invalid platform fee rate"
);
userPlatformFeeRate[_accountAddress] = _platformFeeRate;
​
emit UpdateUserPlatformFeeRate(_accountAddress, _platformFeeRate);
}
​

  • The function currently checks if _platformFeeRate is less than or equal to Constants.PLATFORM_FEE_DECIMAL_SCALER. However, this check alone may not be sufficient to prevent excessively high fee rates.

Impact

Tools Used

Recommendations

Introduce a reasonable upper bound for _platformFeeRate that aligns with the platform's fee structure and business logic.

Updates

Lead Judging Commences

0xnevi Lead Judge 12 months ago
Submission Judgement Published
Invalidated
Reason: Known issue
Assigned finding tags:

[invalid] finding-Admin-Errors-Malicious

The following issues and its duplicates are invalid as admin errors/input validation/malicious intents are1 generally considered invalid based on [codehawks guidelines](https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity#findings-that-may-be-invalid). If they deploy/set inputs of the contracts appropriately, there will be no issue. Additionally admins are trusted as noted in READ.ME they can break certain assumption of the code based on their actions, and

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.