OrderBook
First Flight #43
Beginner FriendlySolidity
100 EXP
View all submissions
Previous Next
Submission Details
Severity: low
Valid

Fee Calculation Precision

Author Revealed upon completion

Root + Impact

Description

  • Normal behavior:

The protocol charges a fee on each order, calculated as a percentage of the order price. The fee is set as an integer (e.g., 3 for 3%) and divided by a precision constant (100), allowing only whole percentage fees.

  • Issue:

The contract cannot support fractional percentage fees (e.g., 0.5%) due to the low precision. This limits the protocol's ability to fine-tune fees for competitive or economic reasons, and may result in overcharging or undercharging users.

uint256 public constant FEE = 3; // 3%
uint256 public constant PRECISION = 100;
uint256 protocolFee = (order.priceInUSDC * FEE) / PRECISION; // @> Only supports whole percent fees

Risk

Likelihood:

  • Protocol may want to adjust fees to a more granular value in the future, such as 0.25% or 0.5%.

  • Current design limits flexibility and may require a contract upgrade to change.

Impact:

  • Inability to set precise fee rates, potentially making the protocol less competitive.

  • Potential loss of protocol revenue or overcharging users, affecting user satisfaction.

Proof of Concept

// This PoC shows that the protocol cannot set a fee of 0.5%.
// Attempt to set FEE = 0.5 (not possible with integer division and PRECISION = 100).
// Only whole numbers (e.g., 1%, 2%, 3%) are possible.

Recommended Mitigation

Increase PRECISION to 10,000 or 1,000,000 to allow for finer fee granularity, enabling fractional percentage fees.
Explanation: Higher precision allows the protocol to set more accurate and competitive fee rates, improving flexibility and user satisfaction.
Updates

Lead Judging Commences

yeahchibyke Lead Judge about 5 hours ago
Submission Judgement Published
Validated
Assigned finding tags:

Fee can be bypassed

Protocol Suffers Potential Revenue Leakage due to Precision Loss in Fee Calculation

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.