Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Missing functionality to withdraw platformFee for offer makers disenfranchises platform users

0xswahili

Summary

There's currently no functionality for offer makers to withdraw platform fee earned when takers create stockInfo. This will discourage users from using the protocol.

Vulnerability Details

When takers create stock via PreMarkets::createTaker, the original offer owner earns a platform fee calculated at Ln254-263:

uint256 remainingPlatformFee = _updateReferralBonus(
platformFee,
depositAmount,
stockAddr,
makerInfo,
referralInfo,
tokenManager
);
​
makerInfo.platformFee = makerInfo.platformFee + remainingPlatformFee;

This fee counts as an earning for the offer owner to motivate more points liquidity provision. However, there's currently no feature to withdraw this fee. For a POC, use this test available from the test suite:

function test_abort_turbo_offer() public {
vm.startPrank(user);
​
preMarktes.createOffer(
CreateOfferParams(
marketPlace,
address(mockUSDCToken),
1000,
0.01 * 1e18,
12000,
300,
OfferType.Ask,
OfferSettleType.Turbo
)
);
vm.stopPrank();
​
vm.startPrank(user1);
mockUSDCToken.approve(address(tokenManager), type(uint256).max);
address stockAddr = GenerateAddress.generateStockAddress(0);
address offerAddr = GenerateAddress.generateOfferAddress(0);
​
preMarktes.createTaker(offerAddr, 500);
vm.stopPrank();
​
vm.prank(user);
preMarktes.abortAskOffer(stockAddr, offerAddr);
vm.startPrank(user1);
address stock1Addr = GenerateAddress.generateStockAddress(1);
preMarktes.abortBidTaker(stock1Addr, offerAddr);
vm.stopPrank();
}

This test shows that there's no way for offers owners to withdraw earned protocol fee.

Impact

Protocol fee earned by offer owners is permanently stuck in the protocol for the beneficiary to withdraw. This counts as a loss to offer owners.

Tools Used

Manual review

Recommendations

Provide a feature for offer owners to withdraw protocol fee earnings.

Updates

Lead Judging Commences

0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-PreMarkets-platformFee-no-withdraw-functionality

Low severity, this can be done using the `Rescuable.sol` contract. Arguably there is no errors here given the `platformFee` variable can represent the historical fees that the protocol has accumulated and need not be updated when fees are withdrawn. However, I believe a more explicit function can be valuable to be more transparent regarding withdrawals. However, I will leave this issue open for escalation for debates because I can see it as arguably invalid as well, but I see no arguments for it being medium severity since there is an alternative to retrieve platform fees, assuming admins are trusted.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.