020.md

Colossal Chiffon Urchin

High

Incorrect accounting in sellVotes

Summary

Inclusion of Protocol Fees and Donations in marketFunds in sellVotes Funds change: fundsReceived Funds distribute: fundsReceived + protocolFee

Root Cause

The marketFunds variable is intended to track the funds invested in the market. However, in the sellVotes function, marketFunds is decremented by fundsReceived, which doesn't include protocol fees. This inconsistency leads to marketFunds inaccurately representing the actual funds invested in the market.

      market.votes[isPositive ? TRUST : DISTRUST] -= 1;
      votePrice = _calcVotePrice(market, isPositive);
      fundsReceived += votePrice;
      votesSold++;
    }
-->    (fundsReceived, protocolFee, ) = previewFees(fundsReceived, false);
    minPrice = votePrice;

    return (votesSold, fundsReceived, votePrice, protocolFee, minPrice, maxPrice);
  }

ReputationMarket.sol#L1041

  function previewFees(
    uint256 amount,
    bool isEntry
  ) private view returns (uint256 funds, uint256 protocolFee, uint256 donation) {
    if (isEntry) {
      protocolFee = (amount * entryProtocolFeeBasisPoints) / BASIS_POINTS_BASE;
      donation = (amount * donationBasisPoints) / BASIS_POINTS_BASE;
    } else {
      protocolFee = (amount * exitProtocolFeeBasisPoints) / BASIS_POINTS_BASE;
    }
-->    funds = amount - protocolFee - donation;
  }

Protocol fees are withdrawn immidiately this means that market creator will not be able to withdraw his funds later in withdrawGraduatedMarketFunds

Internal pre-conditions

No response

External pre-conditions

No response

Attack Path

No response

Impact

Incorrect accounting leading to market creator will not be able to withdraw his funds

PoC

No response

Mitigation

I think it suppose to be like this Funds change: fundsReceived Funds distribute: fundsReceived

    // apply protocol fees
    applyFees(protocolFee, 0, profileId);

    // send the proceeds to the seller
    _sendEth(fundsReceived);
    // tally market funds
-    marketFunds[profileId] -= fundsReceived;
+    marketFunds[profileId] -= (fundsReceived + protocolFee);