OrderBook
First Flight #43
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Precision loss vulnerability allows zero-fee trading for small orders

anchabadze

Description:

The OrderBook contract uses an insufficient precision factor (PRECISION = 100) for fee calculations, causing significant precision loss when computing protocol fees. The fee calculation protocolFee = (order.priceInUSDC * FEE) / PRECISION rounds down to zero for orders with values below 34 wei USDC (0.000034 USDC), effectively allowing free trading for small orders. This violates the intended 3% fee model and creates economic exploits.

Example calculation:

// Order with 33 wei USDC price
protocolFee = (33 * 3) / 100 = 0 // Zero fee due to rounding
sellerReceives = 33 - 0 = 33 // Seller receives 100% instead of 97%

Impact:

  • Protocol loses all fees on orders below 34 wei USDC

  • Intended 3% fee structure becomes inconsistent and exploitable

Recommended Mitigation:

  1. Increase precision factor:

uint256 private constant PRECISION = 1e24; // High precision
uint256 public constant FEE = 3e22; // 3% with high precision

  1. Implement minimum fee protection:

function calculateProtocolFee(uint256 _priceInUSDC) internal pure returns (uint256) {
uint256 preciseFee = (_priceInUSDC * FEE * PRECISION) / (PRECISION * PRECISION);
// Ensure minimum fee of 1 wei if order has value
if (preciseFee == 0 && _priceInUSDC > 0) {
preciseFee = 1;
}
return preciseFee;
}

  1. Add minimum order value:

uint256 public constant MIN_ORDER_VALUE = 1000; // 0.001 USDC minimum

  1. Implement proper validation:

if (_priceInUSDC < MIN_ORDER_VALUE) revert InvalidPrice();

These changes will ensure consistent fee collection, prevent zero-fee exploitation, and maintain the protocol's intended economic model.

Updates

Lead Judging Commences

yeahchibyke Lead Judge
4 months ago
yeahchibyke Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Fee can be bypassed

Protocol Suffers Potential Revenue Leakage due to Precision Loss in Fee Calculation

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.