Stuck fees in MarketFactory as there is no function to withdraw them
Summary
The MarketFactory claims fees from the Market in function fund(), which are stored in the MarketFactory contract. However, the fees have no way to be retrieved from the contract, leading to stuck funds.
Vulnerability Detail
The Market attributes fees to the MarketFactory via claimFee(). It pushes the fees to the MarketFactory when the function is called by it (via fund()).
Notice that function fund() does not send the received funds anywhere, nor is there another function to retrieve these funds, leading to stuck tokens.
Impact
Stuck funds from fees in the MarketFactory contract.
Code Snippet
Function fund() pulls the funds to the MarketFactory, but does not move them afterwards:
function fund(IMarket market) external {
if (!instances(IInstance(address(market)))) revert FactoryNotInstanceError();
market.claimFee();
}
Function claimFee() pushes the funds to the respective receiver, which is the MarketFactory in this case:
function claimFee() external {
Global memory newGlobal = _global.read();
if (_claimFee(address(factory()), newGlobal.protocolFee)) newGlobal.protocolFee = UFixed6Lib.ZERO;
if (_claimFee(address(IMarketFactory(address(factory())).oracleFactory()), newGlobal.oracleFee))
newGlobal.oracleFee = UFixed6Lib.ZERO;
if (_claimFee(coordinator, newGlobal.riskFee)) newGlobal.riskFee = UFixed6Lib.ZERO;
if (_claimFee(beneficiary, newGlobal.donation)) newGlobal.donation = UFixed6Lib.ZERO;
_global.store(newGlobal);
}
/// @notice Helper function to handle a singular fee claim
/// @param receiver The address to receive the fee
/// @param fee The amount of the fee to claim
function _claimFee(address receiver, UFixed6 fee) private returns (bool) {
if (msg.sender != receiver) return false;
token.push(receiver, UFixed18Lib.from(fee));
emit FeeClaimed(receiver, fee);
return true;
}
Tool used
Vscode, Hardhat, Manual Review
Recommendation
Push the funds to the owner in the fund() function (syntax might be wrong):
function fund(IMarket market) external { // TO SUBMIT cant withdraw
if (!instances(IInstance(address(market)))) revert FactoryNotInstanceError();
market.claimFee();
incentive.push(owner, incentive.balanceOf());
}
0x73696d616f
high
Stuck fees in
MarketFactory
as there is no function to withdraw themSummary
The
MarketFactory
claims fees from theMarket
in functionfund()
, which are stored in theMarketFactory
contract. However, the fees have no way to be retrieved from the contract, leading to stuck funds.Vulnerability Detail
The
Market
attributes fees to theMarketFactory
viaclaimFee()
. It pushes the fees to theMarketFactory
when the function is called by it (viafund()
).Notice that function
fund()
does not send the received funds anywhere, nor is there another function to retrieve these funds, leading to stuck tokens.Impact
Stuck funds from fees in the
MarketFactory
contract.Code Snippet
Function
fund()
pulls the funds to theMarketFactory
, but does not move them afterwards:Function
claimFee()
pushes the funds to the respective receiver, which is theMarketFactory
in this case:Tool used
Vscode, Hardhat, Manual Review
Recommendation
Push the funds to the owner in the
fund()
function (syntax might be wrong):Duplicate of #52