Core Contracts

Summary

The FeeCollector contract incorrectly uses basis point values for feeTypes[6] and feeTypes[7]. The comments indicate that these should represent 0.5% and 1.0% fees respectively, yet the code uses 500 and 1000, which on a 10,000 basis point scale equate to 5% and 10%. This misconfiguration will lead to higher fees than intended, thereby messing with the protocol’s fee distribution.

Vulnerability Details

In the FeeCollector contract, feeTypes for Swap Tax and NFT Royalty Fees are defined as follows:

https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/collectors/FeeCollector.sol#L379-L393

As we know, a 10,000 basis point scale is used, where 10,000 represents 100%. Therefore, 0.5% should be 50 basis points (i.e., 50/10,000 = 0.005 or 0.5%), and 1.0% should be 100 basis points.

However, the code uses 500 instead of 50 and 1000 instead of 100. This error means that instead of assigning 0.5% and 1.0%, the contract is effectively assigning 5% and 10% for the respective fee components.

Impact

If this misconfiguration is not corrected, the contract will allocate fees at rates 10 times higher than intended for these fee types.

Tools Used

• Manual Code Review

Recommendations

Update feeTypes[6] and feeTypes[7] to use 50 and 100 where appropriate, ensuring that the values correctly represent 0.5% and 1.0%.