Submission Details
Severity:
Fee Calculation Issues
Relevant GitHub Links
Summary
The fee calculation system in buyOrder function contains serious flaws due to Solidity's integer division limitations and lack of proper fee minimums/precision handling.
Vulnerability Details
In the buyOrder() function, the fee calculation cann't get the amount as the potential of the function because no floating point numbersand only integer operations.And leading integer division truncation.
fee = 150 / 100 = 1 wei
sellerFee = 1 / 2 = 0 wei // Lost precision!
Impact
Small orders are not charged at all. Inaccurate calculation of fees leads to loss of agreement revenue
Tools Used
Manual Review
Recommendations
uint256 constant BPS = 10000; // basic point：1 BPS = 0.01%
uint256 constant FEE_BPS = 100; // 1%
function calculateFees(uint256 price) internal pure returns (uint256 fee, uint256 sellerFee) {
fee = (price * FEE_BPS) / BPS;
sellerFee = fee / 2;
}
Rewards breakdown
nSLOC
181This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.