Lack of maximum fee limit may lead to unexpectedly high fees
Summary
Lack of maximum fee limit may lead to unexpectedly high fees
Vulnerability Details
The onAfterSwap function does not set an upper limit when calculating hookFee. For large transactions, this may result in very high fees that exceed user expectations.
https://github.com/Cyfrin/2024-12-quantamm/blob/main/pkg/pool-hooks/contracts/hooks-quantamm/UpliftOnlyExample.sol
Impact
Assuming hookSwapFeePercentage is set to 10%, a large transaction of 1,000,000 USDC will incur a fee of 100,000 USDC, which may be far higher than the user expects.
Tools Used
vscode
Recommendations
1. Set a reasonable upper limit on the maximum fee amount for a single transaction.
2. Implement a sliding fee scale that decreases as the transaction amount increases.
3. Clearly disclose the expected fee amount to users before the transaction is executed.
Lead Judging Commences
Informational or Gas / Admin is trusted / Pool creation is trusted / User mistake / Suppositions
Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelyhood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.