Skip to content

Latest commit

 

History

History
77 lines (50 loc) · 2.18 KB

File metadata and controls

77 lines (50 loc) · 2.18 KB

Fast Khaki Raccoon

Medium

depositFromPairedLpToken fees are aplied one on another

Summary

When applying the fees depositFromPairedLpToken applies admin and yield fees:

https://github.com/sherlock-audit/2025-01-peapods-finance/blob/main/contracts/contracts/TokenRewards.sol#L148-L162

        uint256 _adminAmt = _getAdminFeeFromAmount(_amountTkn);
        _amountTkn -= _adminAmt;

        if (LEAVE_AS_PAIRED_LP_TOKEN) {
            (, uint256 _yieldBurnFee) = _getYieldFees();

            uint256 _burnAmount = (_amountTkn * _yieldBurnFee) / PROTOCOL_FEE_ROUTER.protocolFees().DEN();
            _adminAmt += _burnAmount;
            _amountTkn -= _burnAmount;

            if (_adminAmt > 0) {
                _processAdminFee(_adminAmt);
            }

            _depositRewards(PAIRED_LP_TOKEN, _amountTkn);
            return;
        }

However due to the order they are applied the yield fee is proportionality reduced by the admin fee, resulting in lower yield fee, thus lower burn amount.

Root Cause

Applying yield fee on the already lowered amount (by the admin fee)

https://github.com/sherlock-audit/2025-01-peapods-finance/blob/main/contracts/contracts/TokenRewards.sol#L148-L162

        uint256 _adminAmt = _getAdminFeeFromAmount(_amountTkn);
        _amountTkn -= _adminAmt; // amount is lowered by admin fee

        if (LEAVE_AS_PAIRED_LP_TOKEN) {
            (, uint256 _yieldBurnFee) = _getYieldFees();

            // yield fee applied on the already lowered amount
            uint256 _burnAmount = (_amountTkn * _yieldBurnFee) / PROTOCOL_FEE_ROUTER.protocolFees().DEN();

Internal Pre-conditions

No response

External Pre-conditions

No response

Attack Path

  1. Both fees are 10%
  2. Deposit of 1000 tokens is made
  3. _amountTkn is reduced by 10% to 900
  4. yield fee is calculated as 10% out of 900, which is 90

Total fees are 190 (19%), even thought they are 10% each -> 20% total Yield fee is 10% lower due to the sequential fee.

Impact

Yield fee is proportionality lower, due to using the already lowered amount.

PoC

No response

Mitigation

Apply the yield fee on the full amount, then decrease it by both fees.