Stratax Contracts
First Flight #57
Beginner FriendlyDeFi
100 EXP
View all submissions
Previous Next
Submission Details
Impact: medium
Likelihood: low

Hardcoded Flash Loan Fee Can Diverge from Aave's Actual Fee

Author Revealed upon completion

Description

flashLoanFeeBps defaults to 9 (0.09%) and is used in calculateOpenParams() to verify that the borrow amount covers flash loan repayment. But the actual fee is whatever Aave passes as _premium in executeOperation(). If Aave governance changes the fee, the pre-trade simulation becomes invalid.

Root Cause

calculateOpenParams() uses the stored flashLoanFeeBps

uint256 flashLoanFee = (flashLoanAmount * flashLoanFeeBps) / FLASHLOAN_FEE_PREC;

But _executeOpenOperation() uses the real Aave-provided premium:

uint256 totalDebt = _amount + _premium;

These can diverge silently after any Aave governance update.

Impact

Trades simulated as viable via calculateOpenParams() will revert at execution if the real fee is higher. Users waste gas on flash loan attempts that can't succeed. Conversely if the owner forgets to update flashLoanFeeBps, all simulations are wrong.

Mitigation

uint256 actualFeeBps = aavePool.FLASHLOAN_PREMIUM_TOTAL();
uint256 flashLoanFee = (flashLoanAmount * actualFeeBps) / 10000;

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!