In `init()` it is not checked if the fees are in the accepted range

[hats-bug-reporter[bot]]

Github username: -- Twitter username: -- Submission hash (on-chain): 0x95ab7ec3aa88b33a4b882ebdfc0724a2439bedd0ea7e3482af39762cdb92f1ad Severity: low

Description: Description\ In init function the default fees values are set.

Later these fees can be updated with setEntryFee, setExitFee, setProtocolFee. Inside these functions, there is a check that ensures the fee value is not more than the max.

 if (exitFee > maxExitFeePercentage) {
            revert Errors.MultiVault_InvalidExitFee();
        }

There is no such check in the init function when setting the default fees.

Attack Scenario\ Describe how the vulnerability can be exploited.

Attachments

1. Proof of Concept (PoC) File

2. Revised Code File (Optional)

   
   +     uint256 maxFeePercentage = generalConfig.feeDenominator / 10;
   +
   +      if ( _defaultVaultFees.entryFee > maxFeePercentage) {
   +            revert Errors.MultiVault_InvalidEntryFee();
   +       }
   +        
   +        if (_defaultVaultFees.exitFee > maxFeePercentage) {
   +            revert Errors.MultiVault_InvalidExitFee();
   +        }
   +
   +        if ( _defaultVaultFees.protocolFee > maxFeePercentage) {
   +            revert Errors.MultiVault_InvalidProtocolFee();
   +        }

vaultFees[0] = VaultFees({ // @audit not checked if the values are in the accepted range entryFee: _defaultVaultFees.entryFee, exitFee: _defaultVaultFees.exitFee, protocolFee: _defaultVaultFees.protocolFee });

<!-- If possible, please provide a second file containing the revised code that offers a potential fix for the vulnerability. This file should include the following information:
- Comment with a clear explanation of the proposed fix.
- The revised code with your suggested changes.
- Any additional comments or explanations that clarify how the fix addresses the vulnerability. -->

[mihailo-maksa]

The report suggests that the init function does not check if default fee values are within an acceptable range.

Label: invalid

Comment: Our deployment script has the fees and other key deployment parameters hardcoded, making it unnecessary to check for their specific values as part of the init method. This design choice prioritizes both gas savings and simplicity.

Comment on the issue: Our deployment script has the fees and other key deployment parameters hardcoded, making it unnecessary to check for their specific values in the init method. This design prioritizes gas savings and simplicity.