Incorrect Fee Calculation in matchingFees Due to Precision Loss and Misinterpretation of FIXEDFEE
Summary
The calculation of matchingFees in the contract contains two key issues
Solidity performs integer division, meaning any fractional result is truncated (rounded down).
If
totalRewardsis a small value (e.g., less than 100) andFIXEDFEE = 10, the calculated fee will incorrectly round to zero, causing fees to be bypassed.
Vulnerability Details
Suppose totalRewards = 5 and FIXEDFEE = 10
Since Solidity truncates decimal values, small totalRewards values will result in a zero fee. making the contrat having no earning.
Impact
incorrect fee deductions, leading to revenue loss or incorrect charges to users.
Tools Used
manual review
Recommendations
Use Basis Points for More Precise Fee Calculation
Modify the calculation to use basis points (1/10,000) instead of percent (1/100):
Appeal created
Informational or Gas
Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelyhood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.