Part 2

Zaros
PerpetualsDEXFoundrySolidity
70,000 USDC
View results
Submission Details
Severity: low
Invalid

Fee distribution skipped when asset value exactly matches minimum threshold

Description

A logic vulnerability has been identified in the FeeConversionKeeper contract's fee distribution mechanism. The issue stems from an overly restrictive comparison operator in the checkFeeDistributionNeeded() function:

function checkFeeDistributionNeeded(
address asset,
uint256 collectedFee
) public view returns (bool distributionNeeded) {
FeeConversionKeeperStorage storage self = _getFeeConversionKeeperStorage();
uint256 assetValue = self.marketMakingEngine.getAssetValue(asset, collectedFee);
distributionNeeded = assetValue > self.minFeeDistributionValueUsd; // BUG: Strict comparison
}

The function employs a strict greater than (>) comparison when evaluating whether fees should be distributed. This implementation creates a boundary condition where fees exactly matching the minFeeDistributionValueUsd threshold are incorrectly excluded from distribution.

The issue manifests when accumulated fees convert to a USD value precisely equal to the minimum threshold. In such cases, the checkUpkeep() function returns false, preventing fee conversion despite meeting the intended minimum value requirement. This behavior can lead to fees remaining unconverted in the system unnecessarily, with the potential for cumulative impact across multiple occurrences of this edge case.

Fix

The solution requires modifying the comparison operator from strict greater than (>) to greater than or equal to (>=):

// Before
distributionNeeded = assetValue > self.minFeeDistributionValueUsd;
// After
distributionNeeded = assetValue >= self.minFeeDistributionValueUsd;

This modification ensures that fee distribution occurs at or above the minimum threshold, aligning with the expected system behavior and preventing unintended fee retention.

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.