Root + Impact

Description

• When users deposit funds, the function '_getParticipationFee' is called to generate fees users are supposed to pay

• The protocol calculates the participation fee using integer division, which inherently truncates (rounds down) the result, leading to a fee of zero for any deposit below a certain threshold(BASE = 10,000). An attacker can exploit this behavior to deposit a large amount of assets in smaller amounts while paying zero total fee, resulting in a significant loss of revenue for the protocol.

Risk

Likelihood:

• When user deposits an asset that when multiplied with the participation fee it is below 10,000(Base)

Impact:

• Fee bypass by users who see this vuln

• Loss of revenue for the protocol

Proof of Concept

Recommended Mitigation