RebateFi Hook

The contract applies a dynamic sell fee using the formula (swapAmount * sellFee) / 100_000. Solidity performs integer division, which truncates downward. When the result is less than 1 full token, feeAmount becomes 0, even though the user is still charged the full percentage via the dynamic fee override. This causes systematic revenue leakage for the hook on small swaps

bool isReFiBuy = _isReFiBuy(key, params.zeroForOne);

uint256 swapAmount = params.amountSpecified < 0
? uint256(-params.amountSpecified)
: uint256(params.amountSpecified);
uint24 fee;

if (isReFiBuy) {
fee = buyFee;
emit ReFiBought(sender, swapAmount);
} else {
fee = sellFee;
// @> BUG: Integer division rounds down → dust is lost forever
uint256 feeAmount = (swapAmount * sellFee) / 100000; // @> truncation here
emit ReFiSold(sender, swapAmount, feeAmount);
}

https://github.com/CodeHawks-Contests/2025-11-rebatefi-hook/blob/add4b298d1246ad2f1df726216849c1c31f83065/src/RebateFiHook.sol#L166

Risk

Likelihood:

• Occurs on every sell swap below the threshold of ~33.33 tokens (at default 3% fee)

• Small swaps are common in production (especially from wallets, bots, or aggregators)

Impact:

• Hook earns zero revenue on a significant portion of sell volume

• ReFiSold event emits misleading/incorrect fee amounts (reports 0 when user actually paid a fee)

Proof of Concept

Recommended Mitigation