Flow

Summary

Recipients can bypass protocol fee increases by monitoring the mempool and frontrunning them with max withdrawals to secure lower fee rates.

Vulnerability Details

When admin increases the protocol fee, there's a window of opportunity in the mempool where recipients can frontrun the increase:

Fee calculation is done within the calculateAmountsFromFee function, called by _withdraw function, at the time of withdraw_._ _withdraw function is being called in 2 functions: withdraw, withdrawMax

Recipients can take benefit of this by frontrunning the fee increase transaction sent by admin, max withdrawing with the old and lower fee percentage.

Below you can see the setProtocolFee function, where protocol fees are set.

Protocol fees are set without any timing limitations, function only checks if the protocol fee amount is under 10%.

Example scenario for 1000 USDC withdrawal: Recipients would call withdrawMaxfunction for maximum saving with the old and lower fee ratio.

• Admin submits tx to change fee from 2% to 10%

2. Recipient frontruns with max withdrawal:

• Pays 2% fee: 20 USDC (receives 980 USDC)

• Instead of 10% fee: 100 USDC (would receive 900 USDC)

• Saves 80 USDC through frontrunning

Impact

Recipient makes unfair saving, while protocol loses fee

Tools Used

Manual Review

Recommendations

Do not apply sharp changes on the fee ratio or use fixed fee for stream durations