BriVault
First Flight #52
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: low
Invalid

Participation Fee Validation Inconsistency

drmanhattan852

[L-1] Participation Fee Validation Inconsistency

Description

The contract validates that the participation fee is below PARTICIPATIONFEEBSPMAX (300 basis points) in the constructor, but doesn't check if it's zero, which could lead to unexpected behavior.

constructor (IERC20 _asset, uint256 _participationFeeBsp, uint256 _eventStartDate, address _participationFeeAddress, uint256 _minimumAmount, uint256 _eventEndDate) ERC4626 (_asset) ERC20("BriTechLabs", "BTT") Ownable(msg.sender) {
if (_participationFeeBsp > PARTICIPATIONFEEBSPMAX){
revert limiteExceede();
}
// ...
participationFeeBsp = _participationFeeBsp;
// ...
}

Risk

Likelihood:

  • Contract deployment always accepts zero value for participationFeeBsp

  • This passes current validation since it checks only for exceeding maximum

Impact:

  • Zero participation fee means no revenue generation for fee recipient

  • Economic model disruption if fees are part of intended incentive design

Proof of Concept

Deploy contract with participationFeeBsp = 0, allowing users to participate without paying any fees while still satisfying validation checks.

// Deploy with zero fee
BriVault vault = new BriVault(
asset,
0, // zero participation fee
startDate,
feeAddress,
minimumAmount,
endDate
);
​
// Result: No participation fees are collected
// This may not be the intended business model

Recommended Mitigation

Add explicit check in constructor to revert if participationFeeBsp == 0, ensuring a meaningful fee is always set.

constructor (IERC20 _asset, uint256 _participationFeeBsp, uint256 _eventStartDate, address _participationFeeAddress, uint256 _minimumAmount, uint256 _eventEndDate) ERC4626 (_asset) ERC20("BriTechLabs", "BTT") Ownable(msg.sender) {
if (_participationFeeBsp > PARTICIPATIONFEEBSPMAX || _participationFeeBsp == 0){
revert invalidFee();
}
// ...
}
Updates

Appeal created

bube Lead Judge 19 days ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Missing Constructor Validation

This is owner action and the owner is assumed to be trusted and to provide correct input arguments.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!