Skip to content

Latest commit

 

History

History
73 lines (47 loc) · 2.03 KB

047.md

File metadata and controls

73 lines (47 loc) · 2.03 KB
Raw

Great Fleece Nightingale

Medium

Users pay fees for failed transactions.

Summary

The fee-first collection pattern in StablecoinHandler causes users to lose fees when subsequent swap operations fail, as fees are collected before validating the complete transaction path.

Root Cause

  • In StablecoinHandler.sol, the _stablecoinSwap function collects fees before executing the main swap operation:

Internal pre-conditions

Since the fee is transferred first, a failure in any subsequent transfer would result in:

  1. Fee already collected by protocol
  2. User loses fee amount
  3. Main swap operation not completed
  4. No automatic fee refund mechanism
  • This creates a scenario where users pay fees for failed transactions.

External pre-conditions

No response

Attack Path

  • User initiates swap with valid parameters
  • Protocol collects fee successfully
  • Main swap operation encounters failure.
  • Transaction reverts
  • Fee remains collected despite failed service

Impact

Users lose fee amounts while receiving no service.

PoC

it("fee_paid_for_failed_transaction", async () => { const stablecoinInputs = { liquiditySafe: deployer, destination: holder, origin: USDC.address, oAmount: ethers.parseUnits("100", 6), target: eMXN.address, tAmount: ethers.parseUnits("1800", 6), stablecoinFeeCurrency: USDC.address, stablecoinFeeSafe: safe.address, feeAmount: ethers.parseUnits("1", 6) };

const initialFeeBalance = await USDC.balanceOf(safe);

// Cause main swap to fail
await USDC.connect(deployer).transfer(otherAddress, await USDC.balanceOf(deployer));

await expect(AmirX.swap(holder, true, stablecoinInputs, defiInputs))
    .to.be.reverted;
    
expect(await USDC.balanceOf(safe))
    .to.equal(initialFeeBalance.add(ethers.parseUnits("1", 6)));

});

Mitigation

No response