There should be a cap on feeRate

[code423n4]

Lines of code

https://github.com/code-423n4/2022-05-cally/blob/main/contracts/src/Cally.sol#L119-L121
https://github.com/code-423n4/2022-05-cally/blob/main/contracts/src/Cally.sol#L282-L286

Vulnerability details

Impact

The feeRate is unlimited in Cally.sol, leading to maliciously moving large taxes from this contract.

Proof of Concept

There is no cap on feeRate

https://github.com/code-423n4/2022-05-cally/blob/main/contracts/src/Cally.sol#L119-L121

    function setFee(uint256 feeRate_) external onlyOwner {
        feeRate = feeRate_;
    }

When collecting protocol fee, unlimited feeRate could lead to maliciously obtaining large amounts of ETH from users

https://github.com/code-423n4/2022-05-cally/blob/main/contracts/src/Cally.sol#L282-L286

    function exercise(uint256 optionId) external payable {
        …
        // collect protocol fee
        uint256 fee = 0;
        if (feeRate > 0) {
            fee = (msg.value * feeRate) / 1e18;
            protocolUnclaimedFees += fee;
        }
        …
    }

Tools Used

None

Recommended Mitigation Steps

There should be a reasonable cap on feeRate. (e.g., 10%)

[outdoteth]

owner can set fee greater than 100%: #48