093.md

Micro Ash Caterpillar

Medium

The user needs to pay the debondfee twice.

Summary

No response

Root Cause

PodUnwrapLocker contract allows users to debond from pods fee free after a time-lock period. If the user chooses to withdraw early, a debondFee + 10% fee will be charged.

However, the debond fee has already been deducted when unwraps a user out of a pod

 function debond(uint256 _amount, address[] memory, uint8[] memory) external override lock noSwapOrFee {
        uint256 _amountAfterFee = _isLastOut(_amount) || REWARDS_WHITELIST.isWhitelistedFromDebondFee(_msgSender())
            ? _amount
            : (_amount * (DEN - _fees.debond)) / DEN;
        uint256 _percSharesX96 = (_amountAfterFee * FixedPoint96.Q96) / _totalSupply;

As the above code,if the user is not the last one out, the _amountAfterFee = (_amount * (DEN - _fees.debond)) / DEN.

Therefore, _receivedAmounts has deducted the debondFee,but in the earlyWithdraw function, the user pays the debondFee again.

As a result, users are charged excessive fees, resulting in losses for the users.

Internal Pre-conditions

No response

External Pre-conditions

1.Alice wrap TKN and mints new pTKN

2.Bob wrap TKN and mints new pTKN

3.Bob debond for a pod and creates a lock

4.Bob chooses to withdraw early

Attack Path

1.Alice wrap TKN and mints new pTKN

2.Bob wrap TKN and mints new pTKN

3.Bob creates a lock and debond for a pod Since Bob is not the last one out, debond fee will be charged

4.Bob chooses to withdraw early Bob pays the debondFee again

As a result, user(Bob) are charged excessive fees, resulting in losses for Bob.

Impact

1.Users are charged excessive fees, resulting in losses for the users. 2.Even if user(bob) chooses to withdraw after unlocking, the debond will not be free

PoC

No response

Mitigation

Consider recalculating penalty fee