Submission Details
Severity:
Fee Calculation and Rounding
Problem:
Fee calculation uses integer division, which can round down to zero for small order amounts, resulting in no fee collected.
Risk:
Attackers can create many small orders to avoid paying any protocol fee, reducing protocol revenue.
uint256 protocolFee = (order.priceInUSDC * FEE) / PRECISION;
Proof of Concept
// Solidity test
function testFeeRounding() public {
// Assume FEE = 3, PRECISION = 100
uint256 price = 1; // 1 USDC
uint256 protocolFee = (price * 3) / 100; // 0
assert(protocolFee == 0); // No fee collected
}
Recommended Mitigation
- uint256 public constant PRECISION = 100;
+ uint256 public constant PRECISION = 1e6;
- uint256 protocolFee = (order.priceInUSDC * FEE) / PRECISION;
+ uint256 protocolFee = (order.priceInUSDC * FEE) / PRECISION;
+ require(protocolFee > 0, "Fee too low");
Updates
Lead Judging Commences
yeahchibyke
about 2 months ago
yeahchibyke about 1 month ago
Submission Judgement Published Assigned finding tags:
Fee can be bypassed
Protocol Suffers Potential Revenue Leakage due to Precision Loss in Fee Calculation
Rewards breakdown
nSLOC
217This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.