Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

There is no method to withdraw the `platformFee`

Bauer

Summary

The protocol does not have a way to withdraw the platformFee, which will remain permanently in the contract.

Vulnerability Details

In the createTaker() function, the protocol records remainingPlatformFee in makerInfo.platformFee. However, there is no method in the protocol to retrieve the platformFee, causing this portion of funds to remain permanently locked in the contract.

uint256 remainingPlatformFee = _updateReferralBonus(
platformFee,
depositAmount,
stockAddr,
makerInfo,
referralInfo,
tokenManager
);
​
makerInfo.platformFee = makerInfo.platformFee + remainingPlatformFee;
​

Impact

The platformFee will remain permanently in the contract.

Tools Used

Recommendations

It is recommended to implement a method to withdraw the platformFee.

Updates

Lead Judging Commences

0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-PreMarkets-platformFee-no-withdraw-functionality

Low severity, this can be done using the `Rescuable.sol` contract. Arguably there is no errors here given the `platformFee` variable can represent the historical fees that the protocol has accumulated and need not be updated when fees are withdrawn. However, I believe a more explicit function can be valuable to be more transparent regarding withdrawals. However, I will leave this issue open for escalation for debates because I can see it as arguably invalid as well, but I see no arguments for it being medium severity since there is an alternative to retrieve platform fees, assuming admins are trusted.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.