Project
One World
NFTDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Zero Fee for Low-Value Transactions Due to Integer Division

mladenov

Summary

The protocol's fee calculation mechanism fails to handle small tier prices correctly due to integer division. When prices are small (e.g., 4) or not properly scaled to token decimals, the fee calculation can result in zero, causing the protocol to lose revenue. Additionally, test cases use unscaled values, potentially masking decimal precision issues.

Vulnerability Details

Fee calculation in MembershipFactory.sol:

function joinDAO(address daoMembershipAddress, uint256 tierIndex) external {
// ...
uint256 tierPrice = daos[daoMembershipAddress].tiers[tierIndex].price;
uint256 platformFees = (20 * tierPrice) / 100; // @audit - Integer division issue
// ...
}

1. If tierPrice = 4

  • platformFees = (20 * 4) / 100 = 0

  • Protocol receives no fee

2. For USDC (6 decimals):

  • tierPrice = 4 should be 4_000000

  • Current tests use unscaled values

Impact

  • Small-value transactions generate no fees

  • Incorrect scaling leads to undercharging

  • Accumulating revenue loss over time

Tools Used

Manual review

Recommendations

Implement decimal-aware fee calculation based on token precision

Updates

Lead Judging Commences

0xbrivan2 Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!