search

code-423n4 / 2021-09-defiprotocol-findings

1 stars 0 forks source link

Zero fees #251

Closed code423n4 closed 2 years ago

code423n4 commented 2 years ago

Handle

goatbug

Vulnerability details

Impact

The fees system is broken. Anyone can easily pay zero fees.

Proof of Concept

Create a bundle of two txs to be mined in one block.

First tx calls mintTo with an extrememly small amount, handleFees is called and importantly lastFee = block.timestamp;

Second tx, do your actual tx with your full amoun uint256 timeDiff = (block.timestamp - lastFee);

timeDiff will be equal to 0

It follows uint256 feePct = timeDiff licenseFee / ONE_YEAR; uint256 fee = startSupply feePct / (BASE - feePct); Fee =0

and therefor no fees accured by publisher or owner. 

        _mint(publisher, fee * (BASE - factory.ownerSplit()) / BASE);
        _mint(Ownable(address(factory)).owner(), fee * factory.ownerSplit() / BASE);

That everything else will also be

Tools Used

Recommended Mitigation Steps

frank-beard commented 2 years ago

fees are not paid by the user minting/burning they are streaming fees meant to be accrued over time. so it is fine if mints in the same block do not all calculate fees

GalloDaSballo commented 2 years ago

Finding is invalid as the warden seems to imply that fees are taken from deposits, while as the sponsor says, fees are streamed to the owner (they are effectively paid via inflation / dilution)