RebateFi Hook
First Flight #53
Beginner FriendlyDeFi
100 EXP
View results
Previous Next
Submission Details
Impact: medium
Likelihood: medium
Invalid

Owner can set extreme or 100%+ fees via `ChangeFee`

comfortnurse021

The ChangeFee function allows the contract owner to update the buy and sell fees used in the hook. The function performs no bounds checking on the provided fee values, allowing the owner to set arbitrarily high (or confiscatory) fees, including values that exceed 100% of the swap amount

// Root causefunction ChangeFee(
bool _isBuyFee,
uint24 _buyFee,
bool _isSellFee,
uint24 _sellFee
) external onlyOwner {
if(_isBuyFee) buyFee = _buyFee; // @> No upper bound validation
if(_isSellFee) sellFee = _sellFee; // @> No upper bound validation
}ause in the codebase with @> marks to highlight the relevant section
https://github.com/CodeHawks-Contests/2025-11-rebatefi-hook/blob/add4b298d1246ad2f1df726216849c1c31f83065/src/RebateFiHook.sol#L84C1-L92

Risk

Likelihood:

  • Owner intentionally or accidentally calls ChangeFee with extreme values

  • No on-chain protection exists — function accepts any uint24 value

Impact:

  • Users can be charged 100%+ of their input on sell swaps → full or partial drainage

  • Extreme fees break economic usability and can be used maliciously if ownership is compromised or misconfigured

Proof of Concept

// Owner calls ChangeFee with malicious values
hook.ChangeFee(true, 100_000, true, 500_000);
​
// Now:
// buyFee = 100_000 → 100% fee on buys
// sellFee = 500_000 → 500% fee on sells
​
// User performs a sell swap with amountSpecified = -1000 tokens (exact input)
// feeAmount = (1000 * 500_000) / 100_000 = 5000 tokens charged as "fee"
// → User loses 5× their input, even though only 1000 tokens are swapped
// Pool receives normal LP fee, but the dynamic fee override makes users pay 500% extra

Recommended Mitigation

​
+ uint24 public constant MAX_FEE_BP = 20_000; // 20% maximum fee (adjustable)
​
function ChangeFee(
bool _isBuyFee,
uint24 _buyFee,
bool _isSellFee,
uint24 _sellFee
) external onlyOwner {
if(_isBuyFee) {
+ require(_buyFee <= MAX_FEE_BP, "Buy fee exceeds maximum");
buyFee = _buyFee;
}
if(_isSellFee) {
+ require(_sellFee <= MAX_FEE_BP, "Sell fee exceeds maximum");
sellFee = _sellFee;
}
}
Updates

Lead Judging Commences

chaossr Lead Judge 8 days ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!