OrderBook

First Flight #43
Beginner FriendlySolidity
100 EXP
View results
Submission Details
Severity: low
Valid

Low precision fee calculation

Root + Impact

Description

  • Normal behavior: The protocol charges a fee on each order, calculated as a percentage (FEE) of the order price, using a precision constant (PRECISION).
    Example: protocolFee = (order.priceInUSDC * FEE) / PRECISION;

  • Issue: With FEE = 3 and PRECISION = 100, the calculation uses integer division. For small order values, this results in the protocol fee being rounded down to zero, allowing users to avoid paying any fee by splitting large orders into many small ones.

uint256 public constant FEE = 3; // 3%
uint256 public constant PRECISION = 100;
uint256 protocolFee = (order.priceInUSDC * FEE) / PRECISION; // @> Integer division truncates small values to zero

Risk

Likelihood:

  • This will occur whenever users create small orders (e.g., less than 34 USDC).

  • Users can intentionally split large trades into many small orders to avoid protocol fees.

Impact:

  • Protocol loses fee revenue on small orders.

  • Potential for fee avoidance by malicious users.

Proof of Concept

A user wants to avoid paying protocol fees by splitting a large trade into many small orders.

// User creates an order with priceInUSDC = 1
// protocolFee = (1 * 3) / 100 = 0
// No fee is collected
// User can repeat this many times to avoid fees on larger trades

Recommended Mitigation

Protocol should increase precision to be able to collect fees on low value orders.

- uint256 public constant FEE = 3; // 3%
- uint256 public constant PRECISION = 100;
+ uint256 public constant FEE = 300_000; // 3% in basis points
+ uint256 public constant PRECISION = 10_000_000;
Updates

Lead Judging Commences

yeahchibyke Lead Judge
about 1 month ago
yeahchibyke Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

Fee can be bypassed

Protocol Suffers Potential Revenue Leakage due to Precision Loss in Fee Calculation

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.