Skip to content

Latest commit

 

History

History
60 lines (41 loc) · 2.12 KB

074.md

File metadata and controls

60 lines (41 loc) · 2.12 KB
Raw

Long Menthol Cow

Medium

Tax is skipped before the end of claiming period

Summary

The rounding error in tax fee calculation will allow early claimers to skip tax before claiming period ends.

Root Cause

The tax fee calculation is rounded down, which can cause tax fee to be 0 in case maxChargeableTax * claimingTimeLeft < AIRDROP_CLAIMING_PERIOD_LENGTH holds. So, in that case claimTaxAmount is 0 and the tax fee is skipped. https://github.com/sherlock-audit/2024-10-usual-labs-v1/blob/main/pegasus/packages/solidity/src/airdrop/AirdropTaxCollector.sol#L232-L233

Internal pre-conditions

  1. maxChargeableTax is set properly by airdrop operator
  2. Prelaunch usd0++ balances are set properly for accounts
  3. Blocktime is within claiming period

External pre-conditions

No response

Attack Path

  1. For example, airdrop operator sets maxChargeableTax = 1000 // 10%
  2. Prelaunch usd0++ balance is set properly for Alice
  3. (uint(182 days) / 1000) / 1 hours = 4 hours before the end of claiming period , Alice claims airdrop and the tax amount to be paid by Alice is 0

Impact

  • Taxes can be skipped before claiming period ends, depends on value of maxChargeableTax: The lower maxChargeableTax is set, the sooner the claimer can bypass tax. And the amount of skipped tax is dependent on account's prelaunch usd0++ balance

PoC

Add the test below to test file AirdropTaxCollector.t.sol:

    function test_calculateClaim_bypass_tax()
        public
        withMaxChargeableTax(TEN_PERCENT)
        userHasPrelaunchBalance(alice, 1000 ether)
        afterClaimingPeriodStart(AIRDROP_CLAIMING_PERIOD_LENGTH - 4 hours)
    {
        uint256 taxAmount = airdropTaxCollector.calculateClaimTaxAmount(alice);
        assertEq(taxAmount, 0);
    }

Run the test and console shows:

Ran 1 test for test/airdrop/AirdropTaxCollector.t.sol:AirdropTaxCollectorTest
[PASS] test_calculateClaim_bypass_tax() (gas: 58884)
Suite result: ok. 1 passed; 0 failed; 0 skipped; finished in 11.46ms (385.00µs CPU time)

Mitigation

Consider rounding up instead of rounding down in the taxFee calculation