Skip to content

Latest commit

 

History

History
42 lines (23 loc) · 1.5 KB

022.md

File metadata and controls

42 lines (23 loc) · 1.5 KB

Kind White Buffalo

Medium

Users pay higher fees than intended when buying votes

Summary

When users buy votes the fees they have to pay are calculated inaccurately causing them to pay more than they should.

Root Cause

In ReputationMarket. _calculateBuy:960 previewFees is called on all of the msg.value sent by the user. This is wrong as the funds the caller has to pay are likely to be lower than all of the funds they sent, which is why any leftover ETH is sent back to the caller.

For example, a user sends 10 ETH and has to pay 10% in fees = 1 ETH. The fees are reduced from the 10 ETH, and 9 ETH is used to buy votes. However, only 8 ETH is spent, and 1 ETH is paid back to the caller. Now, even though, 1 ETH was not used to buy votes, the user still had to pay 0.1 ETH of fees for that 1 ETH.

Internal pre-conditions

No response

External pre-conditions

No response

Attack Path

  1. User buys votes with 10 ETH
  2. 10% of fees are taken away from the 10 ETH
  3. 9 ETH is used to buy votes, however, only 8 ETH is spent, as the price of a vote has become more than 1 ETH
  4. 1 ETH is paid back to the caller, however, they still have to pay 0.1 ETH in fees

Impact

Users that buy votes pay higher fees than intended.

PoC

No response

Mitigation

Do not charge extra fees on ETH that is paid back to the votes buyer.