Skip to content

Latest commit

 

History

History
53 lines (33 loc) · 2.36 KB

042.md

File metadata and controls

53 lines (33 loc) · 2.36 KB

Cheery Mustard Swallow

High

EthosVouch has an incorrect Max fee configuration, total fees are to not be more than 10% but the MAX_TOTAL_FEES is set at 100%, making it possible to charge users higher than expected in fees.

Summary

There is a critical discrepancy between the protocol's documentation regarding Max Total Fees, and the actual implementation of maximum total fees in the smart contract, as the readme clearly states "For both contracts: Maximum total fees cannot exceed 10%" However, the code permits fees up to 100%, which deviates from the stated intention. When Admin sets the various fee, there is potential to go higher than expected as the checkFeeExceedsMaximum will not limit total fees to 10% as was intended, potentially deducting up to 100% in vouch fees if admin was not careful enough with the parameter values of the various fees charged. This oversight creates a significant risk where users could be charged fees far beyond their expectations, leading to the possibility of total loss of funds.

Root Cause

In EthosVouch.sol:120, MAX_TOTAL_FEES is set to 10 000 instead of 1000.

  uint256 public constant MAX_TOTAL_FEES = 10000;

Internal pre-conditions

No response

External pre-conditions

No response

Attack Path

  1. When Admin sets the various fee, there is potential to go higher than expected as the checkFeeExceedsMaximum will not limit total fees at 10%, potentially deducting up to 100% in user fees if admin was not careful enough.
  2. User A vouches for User B.
  3. Due to the incorrectly set MAX_TOTAL_FEES, User A is subjected to an unexpectedly high fee.
  4. This fee could reach up to 100%, causing User A to lose their entire staked amount.

Impact

  1. Unintended Loss of Funds: Users may lose their entire stake due to fees being set up to 100%.
  2. Breach of User Expectations: Users expect a maximum fee of 10% as per the documentation, but the actual implementation allows much higher fees.
  3. Loss of Trust in the Protocol: The discrepancy undermines user trust and the economic model stated by the protocol

PoC

Can be seen here

Mitigation

Modify the MAX_TOTAL_FEES constant to correctly represent 10%:

uint256 public constant MAX_TOTAL_FEES = 1000;