OrderBook
First Flight #43
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Zero-fee on Extremely Small Orders due to Integer Division

jufel

Description: Because the contract computes the protocol fee via pure integer division:

uint256 protocolFee = (order.priceInUSDC * FEE) / PRECISION;

with FEE = 3 and PRECISION = 100. Since order.priceInUSDC is denominated in USDC’s smallest units (1 USDC = 10⁶ micro-USDC), any order priced below ⌈100/3⌉ = 34 micro-USDC (0.000034 USDC) results in protocolFee == 0. In practice, orders of 1–33 micro-USDC incur no fee.

Impact: By listing orders for 1–33 micro-USDC, users can completely avoid paying protocol fees. Although each trade is tiny, this “zero-fee” window is surprising and could be abused in bulk or in derivative contracts, leading to revenue loss and skewed fee expectations.

Proof of Concept: Include the following test in the TestOrderBook.t.sol file:

function testZeroFeeForSmallOrder() public {
// Seller lists 1 token for 33 USDC (below 34 => zero-fee)
vm.startPrank(alice);
wbtc.approve(address(book), 1e8);
uint256 orderId = book.createSellOrder(address(wbtc), 1e8, 33, 3 days);
vm.stopPrank();
​
// Buyer executes
vm.startPrank(dan);
usdc.approve(address(book), 33e6);
book.buyOrder(orderId);
vm.stopPrank();
​
// Contract should have collected 0 USDC
assertEq(usdc.balanceOf(address(book)), 0, "Expected zero fees");
​
// Seller must receive full 33 USDC
assertEq(usdc.balanceOf(alice), 33, "Seller did not get full amount");
}

Mitigation: Ceiling Division: compute fees as

uint256 protocolFee = (order.priceInUSDC * FEE + (PRECISION - 1)) / PRECISION;

guaranteeing protocolFee ≥ 1 whenever order.priceInUSDC > 0.

Minimum-Size Enforcement: require

uint256 minPrice = (PRECISION + FEE - 1) / FEE; // here, 34
require(_priceInUSDC >= minPrice, "Price too small for fee");
Updates

Lead Judging Commences

yeahchibyke Lead Judge 5 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Fee can be bypassed

Protocol Suffers Potential Revenue Leakage due to Precision Loss in Fee Calculation

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!