Error due to divison could make CollateralTracker.sol:s_ITMSpreadFee
equal to zero
#266
Labels
2 (Med Risk)
Assets not at direct risk, but function/availability of the protocol could be impacted or leak value
bug
Something isn't working
duplicate-469
satisfactory
satisfies C4 submission criteria; eligible for awards
Lines of code
https://github.com/code-423n4/2024-04-panoptic/blob/main/contracts/CollateralTracker.sol#L121
https://github.com/code-423n4/2024-04-panoptic/blob/main/contracts/CollateralTracker.sol#L249
https://github.com/code-423n4/2024-04-panoptic/blob/main/contracts/CollateralTracker.sol#L262
https://github.com/code-423n4/2024-04-panoptic/blob/main/contracts/CollateralTracker.sol#L1110
Vulnerability details
Vulnerability Details
Currently uniswap has 4 fee tier
The 0.01% fee tier is currently the lowest fee tier on uniswap, it was added through a governance vote in Nov 2021. In summary Uniswap fees can go below 100 and when this happens the
CollateralTracker.sol:s_ITMSpreadFee
will become zero for that pool._poolFee
will evaluate to zero iffee
is less than 100, sinces_ITMSpreadFee
is calculated based on_poolFee
it will evaluate to zero too.s_ITMSpreadFee = uint128((ITM_SPREAD_MULTIPLIER * _poolFee) / DECIMALS);
Impact
Swap commission will not be paid for affected pools
Proof of Concept
Deploying a pool with fee tier less than
100
i.e0.01%
.When the
PanopticFactory.sol:deployNewPool
is called with afee
of let say 50,it calls the
collateralTracker0.startToken(true, token0, token1, fee, newPoolContract)
with thefee
amount. This is where the division happens and theCollateralTracker.sol:s_ITMSpreadFee
get stored as zeroTool Used
Manual Analysis
Recommendation
Donot divide the fee by 100, use the direct value instead.
Assessed type
Error
The text was updated successfully, but these errors were encountered: