RebateFi Hook
First Flight #53
Beginner FriendlyDeFi
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Inverted Buy/Sell Direction Logic in _isReFiBuy() will result in wrong charging of fees

iamgeorgi

In the function _isReFiBuy() a logical error causes sell fees to be applied to users instead of buy fees

Description

  • Normal behaviour - As stated in the docs, when users are selling eth for Refi buy fees should be applied which can be zero.

  • Issue- Instead of the buy fees being applied, the sell fees will be applied instead causing a serious logical issue charging users the wrong amount

function _isReFiBuy(PoolKey calldata key, bool zeroForOne) internal view returns (bool) {
bool IsReFiCurrency0 = Currency.unwrap(key.currency0) == ReFi; // key.currency0 = REFI
if (IsReFiCurrency0) {
return zeroForOne;
} else {
@> return !zeroForOne;
}
}

Risk

Likelihood:

  • Likelihood - High. It is going to occur everytime a user wants to swap eth for ReFi.

Impact:

  • Wrongly fees are applied. Buy fees can be really small or 0 while sell fees could be higher. In that scenario user that is supposed to have buy fees considered he will have to pay the sell fees instead which results in a big logical issue.

Proof of Concept

  1. Owner deploys the Eth/ReFi pool and initializes it

  2. Some liquidity is being provided

  3. Users start using the pool for swaps and want to swap eth for ReFi

  4. They pay the wrong fee since the protocol's issue

​

Recommended Mitigation

One solution is just to remove the bool zeroForOne parameter in the _isReFiBuyfunction and consider a different approach . The condition can be changed to the following:

function _isReFiBuy(PoolKey calldata key, bool zeroForOne) internal view returns (bool) {
bool IsReFiCurrency0 = Currency.unwrap(key.currency0) == ReFi; // key.currency0 = REFI
if (IsReFiCurrency0) {
- return zeroForOne;
+ return false;
} else {
- return !zeroForOne;
+ return true;
}
}
Updates

Lead Judging Commences

chaossr Lead Judge
15 days ago
chaossr Lead Judge 11 days ago
Submission Judgement Published
Validated
Assigned finding tags:

Inverted buy/sell logic when ReFi is currency0, leading to incorrect fee application.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!