SSSwap

First Flight #41
Beginner FriendlyRust
100 EXP
View results
Submission Details
Impact: medium
Likelihood: medium
Invalid

There is fee calculation precision loss for small amounts

Summary

The fee calculation mechanism in the swap functions suffers from precision loss due to integer division, resulting in zero or reduced fees for small trade amounts.

Vulnerability Details

The fee calculation uses the formula (amount * 3) / 1000 with floor division to compute 0.3% fees. However, this approach causes precision loss for trades smaller than 334 tokens, where the calculated fee rounds down to zero. Specifically:

  • Trades < 334 tokens: Zero fees charged (should be ~1 token)

  • Trades 334-666 tokens: Reduced fees (0.15-0.299% instead of 0.3%)

  • Trades ≥ 667 tokens: Accurate fees (0.3% as intended)

let fee_numerator_u128 = (amount_in_no_fee as u128).checked_mul(3).ok_or(AmmError::Overflow)?;
@> let lp_fees: u64 = fee_numerator_u128.div_floor(&1000) as u64;

Tool Used

  • Manual code review

  • Static analysis of business logic

Impact

  • Revenue Loss: The protocol loses fee income from small trades

  • Economic Incentive: Users can exploit this by splitting large trades into smaller ones to minimize fees

  • Unfair Fee Structure: Creates an unintended fee discount for small trades while larger trades pay the full rate

Recommended Mitigation

Implementing higher precision arithmetic (using basis points) to ensure consistent fee collection across all trade sizes.

Updates

Lead Judging Commences

0xtimefliez Lead Judge 9 days ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.