search

code-423n4 / 2021-04-vader-findings

1 stars 0 forks source link

Fee can be at most 1% and dead code #221

Open code423n4 opened 3 years ago

code423n4 commented 3 years ago

Handle

@cmichelio

Vulnerability details

Vulnerability Details

The Vader._checkEmission functions caps the fee at 1000 = 10% but the max fee that can be returned from the iUTILS(UTILS).getFeeOnTransfer call is 100.

// returns value between 0 and 100
feeOnTransfer = iUTILS(UTILS).getFeeOnTransfer(
    totalSupply,
    maxSupply
); // UpdateFeeOnTransfer
if (feeOnTransfer > 1000) {
    feeOnTransfer = 1000;
} // Max 10% if UTILS corrupted

Impact

It seems like there is a misunderstanding in whether the fee should be at most 1% (Utils.sol) or 10% (Vader.sol).

Recommended Mitigation Steps

Clarify what the max fee should be and adjust either Utils.getFeeOnTransfer or the Vader._checkEmission cap.