code-423n4 / 2022-06-putty-findings

5 stars 0 forks source link

Fees not sent to admin/DAO in some condition #436

Closed code423n4 closed 2 years ago

code423n4 commented 2 years ago

Lines of code

https://github.com/code-423n4/2022-06-putty/blob/3b6b844bc39e897bd0bbb69897f2deff12dc3893/contracts/src/PuttyV2.sol#L498

Vulnerability details

Fees is calculated and sent only in the condition if put is expired or call is exercised No fees sent in either withdraw() or exercise() in condition if put is exercised or call is expired.

Impact

Loss of fees

Recommended Mitigation Steps

Calculate similar fees and send

outdoteth commented 2 years ago

Duplicate: Fees are only applied on puts if they are expired: https://github.com/code-423n4/2022-06-putty-findings/issues/269

HickupHH3 commented 2 years ago

dup of #285