You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Description: Description
When depositing/redeeming there is an entry/exit fee that the user pays to the vault.
This fee is obtained from the user's deposit/redeem amount. So, for example if he sends 5 ETH to the contract, his deposit will be 4.5 ETH, since 0.5 will be the entry fee.
The problem is these fees are held in the contract and there is no way to withdraw them meaning they will be stuck in the contract.
Attack Scenario
Describe how the vulnerability can be exploited.
Attachments
Proof of Concept (PoC) File
Revised Code File (Optional)
Implement similar functions to _transferFeesToProtocolVault for the other fees as well.
The text was updated successfully, but these errors were encountered:
The report suggests that entry and exit fees will be stuck in the contract as there is no way to withdraw them.
Label:invalid and duplicate
Comment:
This report partly duplicates issue #70 regarding claims of exit fees being "stuck" in the contract. The report is invalid as entryFee and exitFee mechanisms reward older and remaining shareholders with increased share prices. These fees are part of totalAssets for each vault and are always redeemable by users due to how share prices are calculated. Therefore, the assets representing these fees can never be "stuck" in the contract.
Github username: --
Twitter username: --
Submission hash (on-chain): 0x5cda359ae4097abe589fff9d66f0706072def990cf9f44129eab74e1bcbd60ac
Severity: high
Description:
Description
When depositing/redeeming there is an entry/exit fee that the user pays to the vault.
This fee is obtained from the user's deposit/redeem amount. So, for example if he sends 5 ETH to the contract, his deposit will be 4.5 ETH, since 0.5 will be the entry fee.
The problem is these fees are held in the contract and there is no way to withdraw them meaning they will be stuck in the contract.
Attack Scenario
Describe how the vulnerability can be exploited.
Attachments
Implement similar functions to
_transferFeesToProtocolVault
for the other fees as well.The text was updated successfully, but these errors were encountered: