Liquidity Management
Gamma
DeFiFoundry
50,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Unnecessary Execution Fee on instant Withdrawals

olami9783

Summary

Users who withdraw when position is already closed still pay an execution fee, even tho no off chain execution is required. The contract currently calls `_payExecutionFee(depositId, false); before checking whether an off-chain action is necessary. If no position is open

Current implementation

} else {
MarketPrices memory prices;
_withdraw(depositId, hex'', prices);

Or

curPositionKey == bytes32(0)

the withdrawal is processed immediately on-chain, meaning the execution fee was charged unnecessarily

Vulnerability Details

​
_payExecutionFee(depositId, false); // users pay execution fee whether off chain execution is required or not
if (curPositionKey != bytes32(0)) {
nextAction.selector = NextActionSelector.WITHDRAW_ACTION;
_settle(); // Settles any outstanding fees and updates state before processing withdrawal
} else {
MarketPrices memory prices;
_withdraw(depositId, hex'', prices);
}
}

Impact

  • Unnecessary cost for users who are actually not going to used it I.e when (curPositionKey == bytes32(0))

  • Loss of trust since users will see it as an unfair advantage reducing trust in the protocol

  • Reduced Capital Efficiency (Extra cost that serves no purpose)

Tools Used

Manual Review

Recommendations

Modify the withdraw function to only call _ payExecutionFee() when an off chain action is required:

if (curPositionKey != bytes32(0)) {
_payExecutionFee(depositId, false);
nextAction.selector = NextActionSelector.WITHDRAW_ACTION;
_settle(); // Settles any outstanding fees and updates state before processing withdrawal
} else {
MarketPrices memory prices;
_withdraw(depositId, hex'', prices);
}
}

And since the protocol does not mention explicitly who are to pay execution fee but users but it is still an issue for who are allowed to pay execution fee

Updates

Lead Judging Commences

n0kto Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

invalid_withdraw_positionIsClosed_does_not_refund_fees

No fee needed in _payExecutionFee when position is closed. Make a PoC if you disagree.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.