OrderBook
First Flight #43
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Fee Calculation Precision

amro135ali

Root + Impact

Description

  • Normal behavior:

The protocol charges a fee on each order, calculated as a percentage of the order price. The fee is set as an integer (e.g., 3 for 3%) and divided by a precision constant (100), allowing only whole percentage fees.

  • Issue:

The contract cannot support fractional percentage fees (e.g., 0.5%) due to the low precision. This limits the protocol's ability to fine-tune fees for competitive or economic reasons, and may result in overcharging or undercharging users.

uint256 public constant FEE = 3; // 3%
uint256 public constant PRECISION = 100;
uint256 protocolFee = (order.priceInUSDC * FEE) / PRECISION; // @> Only supports whole percent fees

Risk

Likelihood:

  • Protocol may want to adjust fees to a more granular value in the future, such as 0.25% or 0.5%.

  • Current design limits flexibility and may require a contract upgrade to change.

Impact:

  • Inability to set precise fee rates, potentially making the protocol less competitive.

  • Potential loss of protocol revenue or overcharging users, affecting user satisfaction.

Proof of Concept

// This PoC shows that the protocol cannot set a fee of 0.5%.
// Attempt to set FEE = 0.5 (not possible with integer division and PRECISION = 100).
// Only whole numbers (e.g., 1%, 2%, 3%) are possible.

Recommended Mitigation

Increase PRECISION to 10,000 or 1,000,000 to allow for finer fee granularity, enabling fractional percentage fees.
Explanation: Higher precision allows the protocol to set more accurate and competitive fee rates, improving flexibility and user satisfaction.
Updates

Lead Judging Commences

yeahchibyke Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Fee can be bypassed

Protocol Suffers Potential Revenue Leakage due to Precision Loss in Fee Calculation

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!