Dria
Swan
NFTHardhat
21,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Buyers can steal dria's royalty portions due to precision loss

zealousdream572

Summary

The transferRoyalties(...)function calculates how much royalties each party receives based on the charged royaltyFeeand platformFeeas seen below:

```

function transferRoyalties(AssetListing storage asset) internal {
// calculate fees
uint256 buyerFee = (asset.price * asset.royaltyFee) / 100;
uint256 driaFee = (buyerFee * getCurrentMarketParameters().platformFee) / 100;
//@audit buyer can steal from the protocol, driaFee == 0 due to rounding down.
​
// first, Swan receives the entire fee from seller
// this allows only one approval from the seller's side
token.transferFrom(asset.seller, address(this), buyerFee);
​
// send the buyer's portion to them
token.transfer(asset.buyer, buyerFee - driaFee);
​
// then it sends the remaining to Swan owner
token.transfer(owner(), driaFee);
}

As seen, the contract transfers from the seller to the contract the entire buyerFee. From the sent buyerFeethe driaFeeis as well calculated. Then the contract reduces the driaFeefrom the sent buyerFeeand sends the remainder to the buyer as thier portion and the rest to the Swan ownerin form of driaFee.

Let's think of the following layman scenario:

  1. The price of an asset SW is 100 and its royaltyFee is set at 5 hence the buyerFeein this case would be (100 * 5)/100which would be 5.

  2. Let the platfrom fee be 3 hence the driaFeewould be (5 * 3/100) which would be 15/100and this would round down to 0 in solidity.

  3. At this point, the contract would send the buyer 5 -0amount which would be 5 and send the Swan Owner nothing 0, due to rounding down.

Due to precision loss, the Swan Owner in some instances might not be able to get anything.

Vulnerability Details

Impact

Tools Used

Recommendations

Updates

Lead Judging Commences

inallhonesty Lead Judge 12 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Rounding Issue in `Swan.sol::transferRoyalties` function

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.