Root + Impact

Description

• The protocol fee is computed via integer division:

Because Solidity truncates toward zero, any fractional remainder is lost. For example, if priceInUSDC * FEE is not evenly divisible by 100, the protocol fee will round down. In extreme cases, a very small order can yield a zero fee: (1 * 3) / 100 == 0. That means the protocol (owner) may receive less than the full 3%.

Risk

Likelihood: High

• Integer division is always used here. Any order price not a multiple of 100 USDC units causes truncation.

Impact: Low

• The owner simply collects slightly less than 3%. Small losses accumulate on many trades, but this is not an exploitable loss to attackers—only a minor accounting discrepancy.

Proof of Concept

This shows that a price of “1” yields a 0 fee due to rounding.

Recommended Mitigation

Adjusting the calculation to round up (e.g. adding PRECISION - 1 before division) ensures at least 1 unit of fee is taken if the true fee is non-zero. This uses fixed-point techniques to avoid truncating the fee to zero. It guarantees closer to an exact 3% fee even for small prices.