hats-finance / Intuition-0x538dbadc50cc87b281cd655f1edbc6ebda02a66a

The smart contracts of the Intuition protocol v1.
https://intuition.systems
Other
0 stars 1 forks source link

Discrepency between `setEntryFee` and `setExitFee` #23

Open hats-bug-reporter[bot] opened 1 week ago

hats-bug-reporter[bot] commented 1 week ago

Github username: @0x3b33 Twitter username: -- Submission hash (on-chain): 0xa390973948d516fd59e50ea55bdac63ac5e1388a3d57000059a67cdf488822fd Severity: low

Description: Description\ EthMultiVault's setEntryFee and setExitFee both set fees for the vault.

However, unlike setExitFee, setEntryFee does not impose any time locks on the change, meaning the fee can be set instantly by the vault admin. Same can be said for setProtocolFee.

This increases trust assumptions and is generally best avoided.

Attachments\ Make setEntryFee the same as setExitFee, i.e., add the time lock mechanic to it.

mihailo-maksa commented 1 week ago

The report highlights a design choice that aligns with our protocol's operational model. Here are the key points:

  1. Protocol Decision: The absence of a time lock for setEntryFee is intentional. Entry fees affect new users who can decide whether to use the protocol based on the current fees. Conversely, exit fees directly impact existing users' profits, necessitating a notice period.
  2. User Protection: Implementing a time lock for setExitFee ensures that users are protected from sudden changes that could negatively affect their profits. Entry fees do not have the same impact, as users can choose not to interact with the protocol.

In conclusion, the current design effectively balances user protection and operational flexibility. Therefore, this issue is invalid.