Dria
Swan
NFTHardhat
21,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

`withdrawPlatformFees` withdraws the entire contract balance which can include fees transferred into the contract

greese

Summary

The withdrawPlatformFees function will withdraw all of the fee tokens in the contract. This can include fees for generators and validators.

Vulnerability Details

When the owner of the contract calls withdrawPlatformFees, it withdraws the entire balance of the contract. The problem with this is that there could be fees still in the contract for generators and validators.

/// @notice Withdraw the platform fees & along with remaining fees within the contract.
function withdrawPlatformFees() public onlyOwner {
feeToken.transfer(owner(), feeToken.balanceOf(address(this)));
}

Rewards for generators and validators are granted through an allowance. Even if they were to automate the process and auto withdrawal on token approval, there is still the possibility the withdraw function could contain rewards.\

/// Increases the allowance by setting the approval to the sum of the current allowance and the additional amount.
/// @param spender spender address
/// @param amount additional amount of allowance
function _increaseAllowance(address spender, uint256 amount) internal {
feeToken.approve(spender, feeToken.allowance(address(this), spender) + amount);
}

If this function were to be called while there are still fee tokens, generators and validators may have allowances for an amount not available in the contract.

Impact

Generators and validators can lose fees

Tools Used

Manual Review

Recommendations

There needs to be a separate variable to track how much protocol fees have been accrued that are eligible to claim.

function withdrawPlatformFees() public onlyOwner {
feeToken.transfer(owner(), feeToken.balanceOf(address(this) - totalFeesToClaim);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 8 months ago
Submission Judgement Published
Validated
Assigned finding tags:

`withdrawPlatformFees` withdraws the entire balance

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.