Submitted by bytes032, also found by zhuXKET, zhuXKET, zhuXKET, qpzm, immeas, immeas, joestakey, kutugu, rbserver, sinarette, R2, carrotsmuggler, cccz, peakbolt, caventa, rvierdiiev, rvierdiiev, anodaram, top1st, RaymondFam, T1MOH, T1MOH and volodya.
The incorrect fee handling in the Position.sol market buy and sell functions can lead to improper fee deductions and wrong trade execution.
In Position.t.sol, _rubiconSwap_ executes the order in the RubiconMarket when opening/closing a position.
rubiconSwap can call either marketBuy or marketSell, depending on the circumstances.
The issue is that both marketBuy and marketSell account for fees, where they shouldnt.
As discussed with the sponsor, the proper approach for v2 trades is do not account for the fee. Instead, it should be taken from the input amount, unlike in v1 (where it was needed for the input amount to have some addition to paying the fee).
So basically, this fee calculation in Position is useless for v2, and thats an issue.
Remove all fee calculations from the _marketBuy and _marketSell functions in Position.sol. As per the discussion with the sponsor, fees should not be accounted for in these functions for v2 trades.
daoio (Rubicon) confirmed via duplicate issue #1149
HickupHH3 (judge) decreased severity to Medium commented:
For this audit, 29 reports were submitted by wardens detailing low risk and non-critical issues. The report highlighted below by catellatech received the top score from the judge.
The following wardens also submitted reports: brgltd,
adriro,
cducrest,
immeas,
lukris02,
tnevler,
favelanky,
Walter,
xmxanuel,
0xAgro,
peanuts,
Udsen,
ast3ros,
oualidpro,
thekmj,
Madalad,
CodeFoxInc,
DijkstraDev,
0xnev,
matrix_0wl,
ro1sharkm,
0x6980,
MalfurionWhitehat,
0xSmartContract,
Kaysoft,
0xmichalis,
Sathish9098 and
Rolezn.
Dear Rubicon v2 Team, as we have gone through each contract within the scope, we have noticed good practices that have been implemented. However, we have identified some inconsistencies that we recommend addressing. We understand that every team has a different level of good practices, but we believe that at least 90% of the recommendations in the following report should be applied for better gas efficiency, readability, and most importantly, safety.
Note: We have provided a description of the situation and recommendations to follow, including articles and resources we have created to help identify the problem and address it quickly, and to implement them in future projects.
