Submitted by yashar
Users can interact with the protocol without paying any taxes.
Whenever a user wants to interact with the protocol (E.g: lock collateral, generate debt, repay debt, etc) he/she should make a call to their proxy contract and the proxy contract will make a delegatecall to BasicActions contract. BasicActions contract will calculate and pay the tax on every:
Given that this is a delegatecall to BasicActions contract and it can be any other contract, a malicious user will be able to deploy a Fake BasicActions contract that doesnt contain any Tax payment mechanism and simply bypass the Tax payment.
To test the scenario please make a file named FakeBasicActions.sol in this path: test/nft/anvil and copy/paste the following contract code that has no Tax payment mechanism in it:
And also make another file called NinjaTests.t.sol in this path: test/nft/anvil and copy/paste the following test code in it:
Test commands: forge test --fork-url $ANVIL_RPC --match-test test_GenerateDebtWithoutTax
VSCode, Foundry
Move the Tax payment mechanism into ODSafeManager contract. E.g:
pi0neerpat (OpenDollar) confirmed
MiloTruck (Judge) decreased severity to Medium and commented:
