Damaged Hazelnut Wolverine - Risk of Exceeding Maximum Buy Fee Due to Unupdated Buy Fee PID

[sherlock-admin3]

Damaged Hazelnut Wolverine

Medium

Risk of Exceeding Maximum Buy Fee Due to Unupdated Buy Fee PID

Summary

The setBuyFeeParameters function allows the contract owner to update various parameters related to the dynamic adjustment of the buy fee. However, after updating these parameters, the Buy Fee PID is not automatically recalculated. This oversight can lead to situations where the effective buy fee exceeds the maximum allowable buy fee (buyFee_max), especially when other contracts like NumaPrinter rely on these parameters without triggering an update of the Buy Fee PID.

Root Cause

https://github.com/sherlock-audit/2024-12-numa-audit/blob/ae1d7781efb4cb2c3a40c642887ddadeecabb97d/Numa/contracts/NumaProtocol/VaultManager.sol#L200

The root cause of this issue is the lack of an automatic recalculation or update of the Buy Fee PID after the parameters affecting its calculation are changed. This can result in the effective buy fee (base fee plus PID adjustment) exceeding the specified maximum (buyFee_max).

Internal pre-conditions

The contract owner calls setBuyFeeParameters to update the parameters related to the buy fee adjustment.
The Buy Fee PID is not recalculated immediately after these updates.
Current buy fees + Current buy fee PID exceed new MAX FEES

External pre-conditions

External contracts or functions, such as those in NumaPrinter, call or rely on the buy fee parameters without invoking updateBuyFeePID.
The effective buy fee (base fee plus PID) is used in calculations or transactions.

Attack Path

The contract owner updates the buy fee parameters using setBuyFeeParameters.
The Buy Fee PID is not recalculated, potentially leading to a situation where the effective buy fee exceeds buyFee_max.
External contracts or functions use the outdated buy fee parameters, leading to transactions with an excessive buy fee.

Impact

Users may incur higher fees than Max fees

PoC

No response

Mitigation

Ensure the Buy Fee PID is recalculated immediately after