Vanguard
First Flight #56
Beginner FriendlyDeFiFoundry
0 EXP
View all submissions
Previous Next
Submission Details
Impact: low
Likelihood: low

totalPenaltyFeesCollected Declared but Never Updated - Broken Accounting

Author Revealed upon completion

Root + Impact

Description

The state variable totalPenaltyFeesCollected is declared and initialized but never updated:

// Line 51 - Declaration
uint256 public totalPenaltyFeesCollected;
​
// Line 87 - Constructor initialization
totalPenaltyFeesCollected = 0;

The hook applies penalty fees in _beforeSwap (lines 175-177):

if (applyPenalty) {
feeOverride = uint24((phasePenaltyBps * 100));
}

However, totalPenaltyFeesCollected is never incremented when penalties are applied.

Impact

Low severity - broken accounting:

  • The variable exists to track total penalty fees but always returns 0

  • Any UI, dashboard, or integration relying on this metric gets incorrect data

  • Protocol transparency is compromised

  • If fee distribution logic depends on this, it would be broken

Proof of Concept

# Search for writes to totalPenaltyFeesCollected
grep -n "totalPenaltyFeesCollected" TokenLaunchHook.sol
​
# Results:
# Line 51: uint256 public totalPenaltyFeesCollected; (declaration)
# Line 87: totalPenaltyFeesCollected = 0; (constructor init)
# NO OTHER WRITES - variable never updated!

Risk

Low impact - informational/accounting issue. No direct fund loss but misleading protocol metrics.

Recommended Mitigation

Update the variable when penalties are applied:

function _beforeSwap(...) internal override returns (...) {
// ... existing logic ...
if (applyPenalty) {
feeOverride = uint24((phasePenaltyBps * 100));
// Add this line to track penalty fees:
uint256 penaltyAmount = (swapAmount * phasePenaltyBps) / 10000;
totalPenaltyFeesCollected += penaltyAmount;
}
}

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!