OrderBook
First Flight #43
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Precision loss vulnerability allows zero-fee trading for small orders

anchabadze

Description:

The OrderBook contract uses an insufficient precision factor (PRECISION = 100) for fee calculations, causing significant precision loss when computing protocol fees. The fee calculation protocolFee = (order.priceInUSDC * FEE) / PRECISION rounds down to zero for orders with values below 34 wei USDC (0.000034 USDC), effectively allowing free trading for small orders. This violates the intended 3% fee model and creates economic exploits.

Example calculation:

// Order with 33 wei USDC price
protocolFee = (33 * 3) / 100 = 0 // Zero fee due to rounding
sellerReceives = 33 - 0 = 33 // Seller receives 100% instead of 97%

Impact:

  • Protocol loses all fees on orders below 34 wei USDC

  • Intended 3% fee structure becomes inconsistent and exploitable

Recommended Mitigation:

  1. Increase precision factor:

uint256 private constant PRECISION = 1e24; // High precision
uint256 public constant FEE = 3e22; // 3% with high precision

  1. Implement minimum fee protection:

function calculateProtocolFee(uint256 _priceInUSDC) internal pure returns (uint256) {
uint256 preciseFee = (_priceInUSDC * FEE * PRECISION) / (PRECISION * PRECISION);
// Ensure minimum fee of 1 wei if order has value
if (preciseFee == 0 && _priceInUSDC > 0) {
preciseFee = 1;
}
return preciseFee;
}

  1. Add minimum order value:

uint256 public constant MIN_ORDER_VALUE = 1000; // 0.001 USDC minimum

  1. Implement proper validation:

if (_priceInUSDC < MIN_ORDER_VALUE) revert InvalidPrice();

These changes will ensure consistent fee collection, prevent zero-fee exploitation, and maintain the protocol's intended economic model.

Updates

Lead Judging Commences

yeahchibyke Lead Judge
6 months ago
yeahchibyke Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Fee can be bypassed

Protocol Suffers Potential Revenue Leakage due to Precision Loss in Fee Calculation

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!