053.md

Slow Tan Swallow

Medium

First voucher does not pay any fee

Summary

When vouching for a user, the voucher must pay a vouchersPoolFee, which can be up to 10% of his vouched amount. That fee is divided between the rest of the vouchers as a reward.

However the first user who vouches, does not pay the fee. That is because _rewardPreviousVouchers would return 0 in such a case, not charging the user anything.

https://github.com/sherlock-audit/2024-11-ethos-network-ii/blob/main/ethos/packages/contracts/contracts/EthosVouch.sol#L706-L717

    for (uint256 i = 0; i < totalVouches; i++) {
      Vouch storage vouch = vouches[vouchIds[i]];
      if (!vouch.archived) {
        totalBalance += vouch.balance;
      }
    }

    if (totalBalance == 0) {
      return totalBalance;
    }

Root Cause

_rewardPreviousVouchers returning 0, allowing the first voucher to vouch without paying a vouchersPoolFee

    if (totalBalance == 0) {
      return totalBalance;
    }

Internal pre-conditions

No response

External pre-conditions

No response

Attack Path

protocolFee is 1% and donationFee is 9%

1. Max total voucher per person are set to 5, as only whales will vouch
2. 5 users vouch, each vouching 100 ETH
3. The first user would pay 1 ETH as protocol fee, but the rest would pay 10 ETH

The first user, either by accident or intent paid a fee which is 10 times less than the rest of the voucher

Impact

First user avoids paying a fee

PoC

No response

Mitigation

Send it as a donation to the one we are vouching for, in order to make the game fair for later participants too and incentive the user who people vouch for at all stages of the game.