Mismatch between implementation & specification/documentation

[code423n4]

Handle

0xRajeev

Vulnerability details

Impact

There is a mismatch between implementation versus specification/documentation. README says: "Streaming fees for a basket are split between the publisher as well as the protocol owner if the protocol fee is turned on" but theFactory contract proposeBasketLicense() requires licenseFee >= minLicenseFee without giving an option to turn this off.

Proof of Concept

https://github.com/code-423n4/2021-09-defiProtocol/blob/52b74824c42acbcd64248f68c40128fe3a82caf6/contracts/contracts/Factory.sol#L74

https://github.com/code-423n4/2021-09-defiProtocol#info

Tools Used

Manual Analysis

Recommended Mitigation Steps

Sync implementation & specification/documentation by implementing logic to turn licensing fees off or by changing the specification/documentation.

[frank-beard]

license fees are required on baskets, the fee being turned on is referring to a share of the license fees going to the protocol owner

[GalloDaSballo]

Invalid finding