Dria
Swan
NFTHardhat
21,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Centralization risk

bhunter

Summary

The protocol has an owner with privileged rights to perform admin tasks that can affect users. Especially when setting market params and platform fee

Vulnerability Details

Market Parameters and platformFee can be set in the following functions by the owner:

function setMarketParameters(SwanMarketParameters memory _marketParameters) external onlyOwner {
require(_marketParameters.platformFee <= 100, "Platform fee cannot exceed 100%");
_marketParameters.timestamp = block.timestamp;
marketParameters.push(_marketParameters);
}
function setFees(uint256 _platformFee, uint256 _generationFee, uint256 _validationFee) public onlyOwner {
platformFee = _platformFee;
generationFee = _generationFee;
validationFee = _validationFee;
}

as it can be seen platformFee can be set to 100 or close 100. If it is set 100 then buyerFee will be 0, or the more platformFee gets close to 100 , the more buyerFee will be close to low(potentially a worthless value). Because when there is a listing or relisting , buyerFee is calculated based on platformFee in the following function:

function transferRoyalties(AssetListing storage asset) internal {
// calculate fees
uint256 buyerFee = (asset.price * asset.royaltyFee) / 100;
uint256 driaFee = (buyerFee * getCurrentMarketParameters().platformFee) / 100;//@audit max platFormFee will leave buyer with nothing
​
// first, Swan receives the entire fee from seller
// this allows only one approval from the seller's side
token.transferFrom(asset.seller, address(this), buyerFee);
​
// send the buyer's portion to them
token.transfer(asset.buyer, buyerFee - driaFee);
​
// then it sends the remaining to Swan owner
token.transfer(owner(), driaFee);
}

Impact

Even if the owner is trusted party, the owner can change the fee without any validation or logging. This may lead to unexpected results and users can be affected substantially if it is very close to 100

Tools Used

Manual Review

Recommendations

  1. Set reasonable min and max constant values for platformFee

  2. Log out the fee setting in the mentioned critical functions above

  3. Clearly specify the owner privileges in the docs

Updates

Lead Judging Commences

inallhonesty Lead Judge 8 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Appeal created

bhunter Submitter
8 months ago
inallhonesty Lead Judge
7 months ago
inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.