Liquidity Management
Gamma
DeFiFoundry
50,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Governance Fee Calculation Allows Small Profits to Bypass Fee Collection

brene

Summary

The _transferToken function calculates governance fees as a percentage of the difference between amount and depositInfo[depositId].amount. However, when this difference is small, the computed fee rounds to zero, meaning no governance fee is deducted, and the user receives the entire amount despite making a profit.

Vulnerability Details

The governance fee is computed as:

function _transferToken(uint256 depositId, uint256 amount) internal {
uint256 fee;
if (amount > depositInfo[depositId].amount) {
>> fee = (amount - depositInfo[depositId].amount) * governanceFee / BASIS_POINTS_DIVISOR;
if (fee > 0) {
collateralToken.safeTransfer(treasury, fee);
}
}
try collateralToken.transfer(depositInfo[depositId].recipient, amount - fee) {}
catch {
collateralToken.transfer(treasury, amount - fee);
emit TokenTranferFailed(depositInfo[depositId].recipient, amount - fee);
}
totalDepositAmount -= depositInfo[depositId].amount;
emit GovernanceFeeCollected(address(collateralToken), fee);
}

Given that governanceFee = 500 (5%) and BASIS_POINTS_DIVISOR = 10_000, the fee calculation rounds down to zero for small differences between amount and depositInfo[depositId].amount. When fee == 0, no funds are transferred to the treasury.

Impact

The contract fails to collect governance fees in cases where profits are small, resulting in a loss of revenue for the protocol.

Tools

Manual Review

Recommendations

Implement a minimum fee threshold to ensure that any positive profit incurs at least a small fee.

Updates

Lead Judging Commences

n0kto Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational or Gas

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelihood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.