[WP-H8] Wrong formula for the fee to be added to the incentivePool

Lines of code Vulnerability details The protocol takes part of the fees to incentivize liquidity, which is recorded as incentivePooltokenAddress on LiquidityPool.sol. However, the formula used to calculate the updated amount of incentivePooltokenAddress in the current implementation is wrong...

Wrong formula when add fee incentivePool can lead to loss of funds.

Lines of code Vulnerability details Impact The getAmountToTransfer function of LiquidityPool updates incentivePooltokenAddress by adding some fee to it but the formula is wrong and the value of incentivePooltokenAddress will be divided by BASEDIVISOR 10000000000 each time. After just a few time,...

DepositBoxERC20 does not support fee-on-transfer token

Lines of code Vulnerability details Impact The transfered amount is saved without checking the actual amount of token received after the transfer. Proof of Concept saveTransferredAmountschainHash, erc20OnMainnet, amount; require ERC20Upgradeableerc20OnMainnet.transferFrom msg.sender, addressthis,...

Deposit Box Does Not Account for Fee On Transfer Tokens Causing the Bridge To Absorb the Fees

Lines of code Vulnerability details Impact The function DepositBoxERC20.depositERC20 does not account for FoT Fee on Transfer tokens. FoT tokens charge a fee when transfer or transferFrom is called and it is subtracted from amount so the receiving address will receive less than amount of tokens...

NFT Creators Can Avoid Paying The Primary Foundation Fee

Lines of code Vulnerability details Impact The primary foundation fee is charged on the initial sale of newly minted NFTs. However, the isCreator && !nftContractToTokenIdToFirstSaleCompletednftContracttokenId check can easily be bypassed to avoid paying the primary foundation fee by selling the...

[WP-M3] PRIMARY_FOUNDATION_FEE can be bypassed

Lines of code Vulnerability details The protocol is charging a different fee rate when the NFT is sold by the creator for the first time on the platform, the fee rate is currently set to a constant value of 15%. For other sales, the fee rate is only 5%. if isCreator &&...

Timelock for critical changes

Lines of code Vulnerability details Impact setDefaultFeePercentage, setCustomFeePercentageForCollateral and setCustomFeePercentageForSafe functions should have a timelock to give users time to react to the fee changes. ref: code-423n4/2021-11-overlay-findings120 Proof of Concept Tools Used Manual...

QA Report

Lower max fee percentage Currently fees can be set as high as 100%, may consider a lower max fee to reduce rug risk src/modules/TurboClerk.sol:38: requirenewDefaultFeePercentage if customFeePercentageForSafe != 0 return customFeePercentageForSafe; --- The text was updated successfully, but these...

Slurp can be frontrun with fee increase

Lines of code Vulnerability details Impact The TurboSafe.slurp function fetches the current fee from the clerk. This fee can be changed. The slurp transaction can be frontrun with a fee increase specifically targeted for the vault or the asset by the clerk and steal the vault yield that should go...

ERC4626 does not work with fee-on-transfer tokens

Lines of code Vulnerability details Impact The docs/video say ERC4626.sol is in scope as its part of TurboSafe The ERC4626.deposit/mint functions do not work well with fee-on-transfer tokens as the amount variable is the pre-fee amount, including the fee, whereas the totalAssets do not include th...

Arbitrary fees

Lines of code Vulnerability details Impact Function transferBribes has a parameter named fees. Essentially, it allows an admin to apply any arbitrary fees and send them to the feeRecipient. This makes no sense because admins can manipulate the amounts however they want with 0 restrictions. I see...

User can refer themselves

Lines of code Vulnerability details Impact User can refer themselves when collect in any CollectModule that collect fee. The will lead to value leak as user can always refer themselves to receive a referral fee as discount. Proof of Concept Recommended Mitigation Steps Check if referrer ==...

Collect modules can fail on zero amount transfers if treasury fee is set to zero

Lines of code Vulnerability details Impact Treasury fee can be zero, while collect modules do attempt to send it in such a case anyway as there is no check in place. Some ERC20 tokens do not allow zero value transfers, reverting such attempts. This way, a combination of zero treasury fee and such...

Basis points constant BPS_MAX is used as minimal fee amount requirement

Lines of code Vulnerability details Impact Base fee modules require minimum fixed fee amount to be at least BPSMAX, which is hard coded to be 10000. This turns out to be a functionality restricting requirement for some currencies. For example, WBTC , 10 in ERC20 token rankings, has decimals of 8...

Cashback on referral

Lines of code Vulnerability details Impact In the fee collect modules like FeeCollectModule there is no prevention of someone submitting a second profile they own as the referrerProfileId in processCollect to receive back part of the fees paid. The referral system is essentially broken as all...

Fee amount too restrictive

Lines of code Vulnerability details Impact In the fee collect modules like FeeCollectModule, the initializePublicationCollectModule checks if the fee amount that each user needs to pay is at least = BPSMAX = 10000. For certain currencies with fewer decimals this is too restrictive. As an example,...

Name squatting

Lines of code Vulnerability details Impact Creating profiles through LensHub/PublishingLogic.createProfile does not cost anything and will therefore result in "name squatting". A whitelisted profile creator will create many handles that are in demand, even if they don't need them, just to flip th...

Unconstrained fee

Lines of code Vulnerability details Impact Token fee in MasterChef can be set to more than 100%, for example by accident causing all deposit calls to fail due to underflow on subtraction when reward is lowered by the fee, thus breaking essential mechanics. Note that after the fee has been set to...

Consistently check account balance before and after transfers for Fee-On-Transfer discrepencies

Handle Dravee Vulnerability details Impact Wrong fateBalance bookkeeping for a user. Wrong fateCreated value emitted. Proof of Concept Taking into account the FOT is done almost everywhere important in the solution already. That's a known practice in the solution. However, it's missing here see...

OpenLevV1.closeTrade with V3 DEX doesn't correctly accounts fee on transfer tokens for repayments

Handle hyh Vulnerability details Impact The amount that OpenLevV1 will receive can be less than V3 DEX indicated as a swap result, while it is used as given for position debt repayment accounting. This way actual funds received can be less than accounted, leaving to system funds deficit, which ca...