Upgraded Q -> M from #268 [1674418407759]

[c4-judge]

Judge has assessed an item in Issue #268 as M risk. The relevant finding follows:

[L-02] Front running attacks by the owner Project has one possible attack vectors by the onlyOwner:

dao.Fees , burnsFees , referralFees , botFees variable; It determines the fees rate The default deposit fees equal zero. Can be updated by onlyOwner with function Fees

When a user use feed, expecting to have zero fee , the owner can frontrun the fee function and increase fees to 10000 bps , If the size is big enough, that may be a significant amount of money.

contracts/Trading.sol: 951 / 952: function setFees(bool _open, uint _daoFees, uint _burnFees, uint _referralFees, uint _botFees, uint _percent) external onlyOwner { 953: unchecked { 954: require(_daoFees >= _botFees+_referralFees2); 955: if (_open) { 956: openFees.daoFees = _daoFees; 957: openFees.burnFees = _burnFees; 958: openFees.referralFees = _referralFees; 959: openFees.botFees = _botFees; 960: } else { 961: closeFees.daoFees = _daoFees; 962: closeFees.burnFees = _burnFees; 963: closeFees.referralFees = _referralFees; 964: closeFees.botFees = _botFees;
965: } 966: require(_percent <= DIVISION_CONSTANT); 967: vaultFundingPercent = _percent; 968: } 969: } Recommended Mitigation Steps Use a timelock to avoid instant changes of the parameters.

[c4-judge]

GalloDaSballo marked the issue as duplicate of #377

[c4-judge]

GalloDaSballo marked the issue as satisfactory