Project
One World
NFTDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Hardcoded fees

mladenov

Summary

The protocol has a hardcoded 20% platform fee that cannot be modified. This means the fee percentage is permanently set in the code and cannot be adjusted by protocol governance or administrators. In dynamic market conditions, the ability to adjust fees is crucial - during bull markets, users might be willing to pay higher fees, while in bear markets, lower fees could help maintain user activity and protocol revenue.

Vulnerability Details

1. The fee is hardcoded at 20% in the joinDAO function

function joinDAO(address daoMembershipAddress, uint256 tierIndex) external {
require(daos[daoMembershipAddress].noOfTiers > tierIndex, "Invalid tier.");
require(daos[daoMembershipAddress].tiers[tierIndex].amount > daos[daoMembershipAddress].tiers[tierIndex].minted, "Tier full.");
uint256 tierPrice = daos[daoMembershipAddress].tiers[tierIndex].price;
uint256 platformFees = (20 * tierPrice) / 100; // @audit Hardcoded 20% fee
daos[daoMembershipAddress].tiers[tierIndex].minted += 1;
IERC20(daos[daoMembershipAddress].currency).transferFrom(_msgSender(), owpWallet, platformFees);
IERC20(daos[daoMembershipAddress].currency).transferFrom(_msgSender(), daoMembershipAddress, tierPrice - platformFees);
IMembershipERC1155(daoMembershipAddress).mint(_msgSender(), tierIndex, 1);
emit UserJoinedDAO(_msgSender(), daoMembershipAddress, tierIndex);
}

2. No function exists to modify this fee percentage

3. The fee calculation is done using basic integer division which can lead to rounding issues

Impact

1.Protocol cannot adjust fees based on market conditions which might result in:

  • Lost revenue during bull markets

  • Reduced user activity during bear markets

2. For small payment amounts, due to integer division:

  • Fees might round down to zero

  • Protocol loses revenue

Tools Used

Manual review

Recommendations

Implement a configurable fee system that allows protocol administrators to adjust the fee percentage through a governance process. This should include a maximum fee cap to protect users.

Updates

Lead Judging Commences

0xbrivan2 Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Design choice
0xbrivan2 Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!