search

sablier-labs / flow

🍃 Smart contracts of the Sablier Flow protocol.
Other
10 stars 2 forks source link

Round up protocol fee to 1 if its 0 #331

Closed smol-ninja closed 1 week ago

smol-ninja commented 1 week ago

Reported in Codehawk audit, a user can bypass paying the protocol fee by withdrawing in smaller amounts such that 10% of it becomes 0. For example,

Thus, as a fix, round up the protocol fee to 1 token if the following conditions are met:

  1. withdraw amount > 0 AND
  2. protocol fee (10% of withdraw amount ) == 0

Note: Double check that the function reverts when withdraw amount is 0 so that users do not pay a fee of 1 token when there are no tokens to withdraw.

smol-ninja commented 1 week ago

The same issue exists in depositViaBroker as well. Should we deduct 1 there as well in case fee rounds down to zero (the same problem exists in lockup too)? Or should we ignore it and let broker manage it on their side (since deposit amount is in their control)?

smol-ninja commented 1 week ago

https://github.com/sablier-labs/flow/pull/336#issuecomment-2471047267