Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Maker cannot get the related platform fee

jennifersun

Summary

Some platform fees are calculated and accured for the maker. But the platform fee is not added into the maker's balance.

Vulnerability Details

When one user trades as one taker, the user has to pay some platform fee. The platform fee is splited into several parts: platform fee for referrer, platform fee for the taker, left platform fee for the maker.
The platform fee for the referrer and for the taker is timely updated and added into the referrer and taker's balance. And they can withdraw if they want. But the platform fee for the maker(left part) is recorded into the variable makerInfo.platformFee. However, this part of platform fee is never updated into the maker's balance. It means that the maker cannot withdraw this part of platform fee.

function _updateReferralBonus(
uint256 platformFee,
uint256 depositAmount,
address stockAddr,
MakerInfo storage makerInfo,
ReferralInfo memory referralInfo,
ITokenManager tokenManager
) internal returns (uint256 remainingPlatformFee) {
if (referralInfo.referrer == address(0x0)) {
remainingPlatformFee = platformFee;
} else {
// Platform fee will be splited, one part is sent to the referrer, taker's referrer.
uint256 referrerReferralBonus = platformFee.mulDiv(
referralInfo.referrerRate,
Constants.REFERRAL_RATE_DECIMAL_SCALER,
Math.Rounding.Floor
);
​
/**
* @dev update referrer referral bonus
* @dev update authority referral bonus
*/
tokenManager.addTokenBalance(
TokenBalanceType.ReferralBonus,
referralInfo.referrer,
makerInfo.tokenAddress,
referrerReferralBonus
);
​
uint256 authorityReferralBonus = platformFee.mulDiv(
referralInfo.authorityRate,
Constants.REFERRAL_RATE_DECIMAL_SCALER,
Math.Rounding.Floor
);
// Taker will add one part
tokenManager.addTokenBalance(
TokenBalanceType.ReferralBonus,
_msgSender(),
makerInfo.tokenAddress,
authorityReferralBonus
);
​
remainingPlatformFee =
platformFee -
referrerReferralBonus -
authorityReferralBonus;
...
}
}
​
function createTaker(address _offer, uint256 _points) external payable {
...
uint256 remainingPlatformFee = _updateReferralBonus(
platformFee,
depositAmount,
stockAddr,
makerInfo,
referralInfo,
tokenManager
);
// The left platform Fee will be distributed to the maker.
makerInfo.platformFee = makerInfo.platformFee + remainingPlatformFee;
​
_updateTokenBalanceWhenCreateTaker(
_offer,
tradeTax,
depositAmount,
offerInfo,
makerInfo,
tokenManager
);
​
}

Impact

The maker will lose some expected platform fee.

Tools Used

Manual

Recommendations

Timely update maker's platform fee into the maker's balance or add one function to allow the maker update or withdraw the platform fee in variable makerInfo.platformFee.

Updates

Lead Judging Commences

0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-PreMarkets-platformFee-no-withdraw-functionality

Low severity, this can be done using the `Rescuable.sol` contract. Arguably there is no errors here given the `platformFee` variable can represent the historical fees that the protocol has accumulated and need not be updated when fees are withdrawn. However, I believe a more explicit function can be valuable to be more transparent regarding withdrawals. However, I will leave this issue open for escalation for debates because I can see it as arguably invalid as well, but I see no arguments for it being medium severity since there is an alternative to retrieve platform fees, assuming admins are trusted.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.