Tadle
Tadle
DeFi
30,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Unable to withdraw platform fee, due to no mechanism to withdraw them

zukanopro

Summary

There is no function to withdraw fee, lead to fee stuck in the contract

Vulnerability Details

In createTaker function, platformFee is added after adding them:

function createTaker(address _offer, uint256 _points) external payable {
. . . . . . .
uint256 remainingPlatformFee = _updateReferralBonus(
platformFee,
depositAmount,
stockAddr,
makerInfo,
referralInfo,
tokenManager
);
​
makerInfo.platformFee = makerInfo.platformFee + remainingPlatformFee;
. . . . . . .
}

But currently, there is no mechanism to withdraw them. The only way to withdraw token is through TokenManager#withdraw() function, but it only allow them to withdraw token balance of caller, but not platformFee.

Impact

Token is stuck in the contract

Tools Used

Manual review

Recommendations

Add mechanism to withdraw these tokens

Updates

Lead Judging Commences

0xnevi Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-PreMarkets-platformFee-no-withdraw-functionality

Low severity, this can be done using the `Rescuable.sol` contract. Arguably there is no errors here given the `platformFee` variable can represent the historical fees that the protocol has accumulated and need not be updated when fees are withdrawn. However, I believe a more explicit function can be valuable to be more transparent regarding withdrawals. However, I will leave this issue open for escalation for debates because I can see it as arguably invalid as well, but I see no arguments for it being medium severity since there is an alternative to retrieve platform fees, assuming admins are trusted.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.