Submission Details
Severity:
Setting `feeTypes[6]` on `FeeCollector::_initializeFeeTypes` has wrong value
Summary
On FeeCollector::_initializeFeeTypes#L380, it set the feeTypes[6].
But the values here are wrong.
Vulnerability Details
when the BASIS_POINTS is 10_000,
On feeTypes[6] it says 2% total which should be 200.
The 0.5% should be 50.
The 1% should be 100
The actual implementation will be a total 20% not 2%
FeeCollector::_initializeFeeTypes#L380
/**
* @dev Initializes default fee types according to protocol rules
*/
function _initializeFeeTypes() internal {
// Protocol Fees: 80% to veRAAC holders, 20% to treasury
feeTypes[0] = FeeType({
veRAACShare: 8000, // 80%
burnShare: 0,
repairShare: 0,
treasuryShare: 2000 // 20%
});
// ...OTHER_CODES...
// Buy/Sell Swap Tax (2% total)
380:: feeTypes[6] = FeeType({ // @audit wrong values
veRAACShare: 500, // 0.5%
burnShare: 500, // 0.5%
repairShare: 1000, // 1.0%
treasuryShare: 0
385:: });
// ..OTHER_CODES...
}
Impact
The feeType will get the wrong state on deployment. As this will be used in the calculation, it will be a loss of funds.
Tools Used
Manual review
Recommendations
2% total which should be 200.
The 0.5% should be 50 when the BASIS_POINTS is 10_000.
The 1% should be 100
```Solidity
/**
* @dev Initializes default fee types according to protocol rules
*/
function _initializeFeeTypes() internal {
// Protocol Fees: 80% to veRAAC holders, 20% to treasury
feeTypes[0] = FeeType({
veRAACShare: 8000, // 80%
burnShare: 0,
repairShare: 0,
treasuryShare: 2000 // 20%
});
// ...OTHER_CODES...
// Buy/Sell Swap Tax (2% total)
380:: feeTypes[6] = FeeType({ // @audit wrong values
- veRAACShare: 500, // 0.5%
+ veRAACShare: 50, // 0.5%
- burnShare: 500, // 0.5%
+ burnShare: 50, // 0.5%
- repairShare: 1000, // 1.0%
+ repairShare: 100, // 1.0%
treasuryShare: 0
385:: });
// ..OTHER_CODES...
}
Updates
Lead Judging Commences
inallhonesty 6 months ago
Submission Judgement Published Assigned finding tags:
Fee shares for fee type 6 and 7 inside FeeCollector do not total up to the expected 10000 basis points, this leads to update problems, moreover they are 10x the specifications
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.