Tadle
Tadle
DeFi
30,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

`PlatFormFeeRate` can be lesser than `basePlatformFee`

fourb

Summary

The updateUserPlatformFeeRate() can be used to set the userPlatformFeeRate to a value lower than basePlatformFee

Vulnerability Details

in the SystemConfig contract you can find a function called updateUserPlatformFeeRate() which updates userPlatformFees, However in the initialization of this contract a basePlatformFee is set, this means if fees aren't updated this should be the fees to apply, so we can say this is the base of the user platform fees and no one user should pay less than this. But updateUserPlatformFeeRate() can update the value to a lower value than the base fee, thereby breaking the stated invariant.

this is a test you can add the current testfile to see that it is possible

function test_platform_fee() public {
vm.prank(user1);
//setting the PlatformFeeRate to 44 a figure way less than basPlatformFee
systemConfig.updateUserPlatformFeeRate(address(45),44);
​
uint256 paltformFee = systemConfig.getPlatformFeeRate(address(45));
// checking whether the current fee has been set
assertEq(paltformFee,44);
// confirming that the new fee is less than the base fee
assertLe(paltformFee,basePlatformFeeRate);
}

Impact

userPlatformFeeRate can be set to a value lower than basePlatformFees

Tools Used

manual review

Recommendations

A check should be implemented to make sure userPlatformFeeRate is not lower than basePlatformFee

Updates

Lead Judging Commences

0xnevi Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Known issue
Assigned finding tags:

[invalid] finding-Admin-Errors-Malicious

The following issues and its duplicates are invalid as admin errors/input validation/malicious intents are1 generally considered invalid based on [codehawks guidelines](https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity#findings-that-may-be-invalid). If they deploy/set inputs of the contracts appropriately, there will be no issue. Additionally admins are trusted as noted in READ.ME they can break certain assumption of the code based on their actions, and

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.