Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

EntryFee and ExitFee will be stuck in the contract #85

Open
hats-bug-reporter bot opened this issue Jul 1, 2024 · 1 comment
Open

EntryFee and ExitFee will be stuck in the contract #85

hats-bug-reporter bot opened this issue Jul 1, 2024 · 1 comment
Labels
bug Something isn't working invalid This doesn't seem right

Comments

@hats-bug-reporter
Copy link

Github username: --
Twitter username: --
Submission hash (on-chain): 0x5cda359ae4097abe589fff9d66f0706072def990cf9f44129eab74e1bcbd60ac
Severity: high

Description:
Description
When depositing/redeeming there is an entry/exit fee that the user pays to the vault.
This fee is obtained from the user's deposit/redeem amount. So, for example if he sends 5 ETH to the contract, his deposit will be 4.5 ETH, since 0.5 will be the entry fee.

The problem is these fees are held in the contract and there is no way to withdraw them meaning they will be stuck in the contract.

Attack Scenario
Describe how the vulnerability can be exploited.

Attachments

  1. Proof of Concept (PoC) File
  1. Revised Code File (Optional)
    Implement similar functions to _transferFeesToProtocolVault for the other fees as well.
@hats-bug-reporter hats-bug-reporter bot added the bug Something isn't working label Jul 1, 2024
@mihailo-maksa mihailo-maksa added the invalid This doesn't seem right label Jul 1, 2024
@mihailo-maksa
Copy link
Collaborator

The report suggests that entry and exit fees will be stuck in the contract as there is no way to withdraw them.

Label: invalid and duplicate

Comment:
This report partly duplicates issue #70 regarding claims of exit fees being "stuck" in the contract. The report is invalid as entryFee and exitFee mechanisms reward older and remaining shareholders with increased share prices. These fees are part of totalAssets for each vault and are always redeemable by users due to how share prices are calculated. Therefore, the assets representing these fees can never be "stuck" in the contract.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working invalid This doesn't seem right
Projects
None yet
Development

No branches or pull requests

1 participant