RebateFi Hook
First Flight #53
Beginner FriendlyDeFi
100 EXP
View results
Previous Next
Submission Details
Impact: medium
Likelihood: high
Invalid

Incorrect Fee Precision Results in Overcharging Swap Fees

cyfe45

Description

  • The protocol claims to apply a 0.3% swap fee on sell transactions. However, the current feeAmount calculation mistakenly uses a denominator of 100_000, producing an effective fee rate of 3%, which is ten times higher than intended.

function _beforeSwap(
address sender,
PoolKey calldata key,
SwapParams calldata params,
bytes calldata
) internal override returns (bytes4, BeforeSwapDelta, uint24) {
bool isReFiBuy = _isReFiBuy(key, params.zeroForOne);
uint256 swapAmount = params.amountSpecified < 0
? uint256(-params.amountSpecified)
: uint256(params.amountSpecified);
​
uint24 fee;
if (isReFiBuy) {
fee = buyFee;
emit ReFiBought(sender, swapAmount);
} else {
fee = sellFee;
@> uint256 feeAmount = (swapAmount * sellFee) / 100000;
emit ReFiSold(sender, swapAmount, feeAmount);
}
return (
BaseHook.beforeSwap.selector,
BeforeSwapDeltaLibrary.ZERO_DELTA,
fee | LPFeeLibrary.OVERRIDE_FEE_FLAG
);
}

Risk

Likelihood: Medium

  • While no immediate impact exists because the calculation is not fully integrated, any refactor that uses this current formula risks applying a 3% fee instead of 0.3%.

Impact: High

  • Charging swap fees significantly higher than advertised undermines protocol trust and may drive users away, impacting trading volume and platform reputation.

Proof of Concept

Run the following test using Foundry to observe the incorrect vs correct fee calculations (forge test --mt test_FeeCalc -vvv):

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.26;
​
import "forge-std/console.sol";
import {Test} from "forge-std/Test.sol";
​
contract TestReFiSwapRebateHookKG is Test {
​
function test_FeeCalc() public pure {
uint256 swapAmount = 1_000_000;
uint24 testSellFee = 3000;
​
uint256 feeAmount = (swapAmount * testSellFee) / 100_000;
​
uint256 testFeeAmount = (swapAmount * testSellFee) / 1_000_000;
​
console.log("The calculated contract feeAmount:", feeAmount);
console.log("The correct feeAmount:", testFeeAmount);
}
}

Recommended Mitigation

  • By changing the denominator to 1_000_000 to reflect the intended 0.3% fee precision:

- uint256 feeAmount = (swapAmount * sellFee) / 100000;
+ uint256 feeAmount = (swapAmount * sellFee) / 1_000_000;
Updates

Lead Judging Commences

chaossr Lead Judge
14 days ago
chaossr Lead Judge 11 days ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!