OrderBook
First Flight #43
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Zero-fee on Extremely Small Orders due to Integer Division

jufel

Description: Because the contract computes the protocol fee via pure integer division:

uint256 protocolFee = (order.priceInUSDC * FEE) / PRECISION;

with FEE = 3 and PRECISION = 100. Since order.priceInUSDC is denominated in USDC’s smallest units (1 USDC = 10⁶ micro-USDC), any order priced below ⌈100/3⌉ = 34 micro-USDC (0.000034 USDC) results in protocolFee == 0. In practice, orders of 1–33 micro-USDC incur no fee.

Impact: By listing orders for 1–33 micro-USDC, users can completely avoid paying protocol fees. Although each trade is tiny, this “zero-fee” window is surprising and could be abused in bulk or in derivative contracts, leading to revenue loss and skewed fee expectations.

Proof of Concept: Include the following test in the TestOrderBook.t.sol file:

function testZeroFeeForSmallOrder() public {
// Seller lists 1 token for 33 USDC (below 34 => zero-fee)
vm.startPrank(alice);
wbtc.approve(address(book), 1e8);
uint256 orderId = book.createSellOrder(address(wbtc), 1e8, 33, 3 days);
vm.stopPrank();
​
// Buyer executes
vm.startPrank(dan);
usdc.approve(address(book), 33e6);
book.buyOrder(orderId);
vm.stopPrank();
​
// Contract should have collected 0 USDC
assertEq(usdc.balanceOf(address(book)), 0, "Expected zero fees");
​
// Seller must receive full 33 USDC
assertEq(usdc.balanceOf(alice), 33, "Seller did not get full amount");
}

Mitigation: Ceiling Division: compute fees as

uint256 protocolFee = (order.priceInUSDC * FEE + (PRECISION - 1)) / PRECISION;

guaranteeing protocolFee ≥ 1 whenever order.priceInUSDC > 0.

Minimum-Size Enforcement: require

uint256 minPrice = (PRECISION + FEE - 1) / FEE; // here, 34
require(_priceInUSDC >= minPrice, "Price too small for fee");
Updates

Lead Judging Commences

yeahchibyke Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Fee can be bypassed

Protocol Suffers Potential Revenue Leakage due to Precision Loss in Fee Calculation

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.