Summary

Since platform fees are computed before applying an OfferInfo's collateralRate, users can craft offers which accrue negligible platform fees meanwhile evaluate to a rational getDepositAmount(OfferType,uint256,uint256,bool,Math.Rounding).

Vulnerability Details

The PreMarkets contract compute both the platformFee and tradeTax based upon the raw inbound depositAmount parameter:

However, this depositAmount does not represent the value of the entire transaction, which can be amplified later.

In the call to _depositTokenWhenCreateTaker(uint256,uint256,uint256,MakerInfo,OfferInfo,ITokenManager) which follows immediately after computing the platform fees, we can see the inbound deposit amount can be amplified based upon the OfferInfo's collateralRate in the subsequent call to getDepositAmount(OfferType,uint256,uint256,bool,Math.Rounding):

Specifically:

Note, it is important to emphasize that collateralRate expressly increases _amount, since when creating an offer:

if (params.collateralRate < Constants.COLLATERAL_RATE_DECIMAL_SCALER) { /// @audit must_be_over_unity

revert InvalidCollateralRate();

}

This means a user can express an extremely high collateralRate with a comparatively low (i.e. 1 wei) offer amount to reduce the protocol's fees at no intrinsic loss. This allows the user to procure a greater claim to the share of overall transaction value at expense of the protocol.

Impact

Users can subvert platform fees to gain an unfair share of overall transaction value.

Tools Used

Manual Review

Recommendations

Platform fees should be computed as a function of the evaluated transferAmount instead of the initial depositAmount: