Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Albort - Incorrect Fee Rate Selection #76

Open
sherlock-admin3 opened this issue Sep 24, 2024 · 1 comment
Open

Albort - Incorrect Fee Rate Selection #76

sherlock-admin3 opened this issue Sep 24, 2024 · 1 comment
Labels
Sponsor Disputed The sponsor disputed this issue's validity Won't Fix The sponsor confirmed this issue will not be fixed

Comments

@sherlock-admin3
Copy link

sherlock-admin3 commented Sep 24, 2024

Albort

Medium

Incorrect Fee Rate Selection

Summary

The logic for selecting the fee_rate may not accurately reflect the intended fee structure, especially when swapping between base tokens and quote tokens.

Vulnerability Detail

When swapping from the quote token to a base token, the fee rate should typically be taken from the pool associated with the base token being received.
When swapping from a base token to the quote token, the fee rate should come from the pool of the base token being sold.
The current logic may apply the wrong fee rate or an inconsistent fee rate, especially when swapping between two base tokens.

Impact

Code Snippet

https://github.com/sherlock-audit/2024-08-woofi-solana-deployment/blob/main/WOOFi_Solana/programs/woofi/src/instructions/query.rs#L86

Tool used

Manual Review

Recommendation

@toprince
Copy link

Not valid.
Swap fee is in quote token.

@sherlock-admin3 sherlock-admin3 added Sponsor Disputed The sponsor disputed this issue's validity Won't Fix The sponsor confirmed this issue will not be fixed labels Oct 13, 2024
@sherlock-admin4 sherlock-admin4 changed the title Zesty Sage Tapir - Incorrect Fee Rate Selection Albort - Incorrect Fee Rate Selection Oct 15, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Sponsor Disputed The sponsor disputed this issue's validity Won't Fix The sponsor confirmed this issue will not be fixed
Projects
None yet
Development

No branches or pull requests

2 participants