Submission Details
Severity:
Missing Maximum Fee Validation in `withdraw` Function
Summary
The withdraw function lacks a check to ensure the protocol fee does not exceed a maximum allowable limit. This oversight could result in excessive fees being applied to user withdrawals.
Vulnerability Details
The withdraw function checks if the protocol fee is greater than zero but does not validate it against a maximum fee cap.
// ... SNIP ...
if (protocolFee > ZERO) {
// Calculate the protocol fee amount and the net withdraw amount.
(protocolFeeAmount, amount) = Helpers.calculateAmountsFromFee({ totalAmount: amount, fee: protocolFee });
// Safe to use unchecked because addition cannot overflow.
unchecked {
// Effect: update the protocol revenue.
protocolRevenue[token] += protocolFeeAmount;
}
}
// ... SNIP ...
Impact
Users may receive significantly less than expected due to high fees and also they may lose trust in the platform if fees are perceived as unfair or excessive
Tools Used
Manual Review
Recommendations
Validate the protocol fee against this maximum limit within the withdraw function
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
69929 USDC / LOC
19,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.