Submitted by adriro, also found by minhtrng, zhuXKET, zhuXKET, zhuXKET, minhtrng, McToady, McToady, LaScaloneta, joestakey, sinarette, kutugu, __141345__, ast3ros, sces60107, cccz, cloudjunky, rvierdiiev, cccz, Ace-30, cccz, zaevlad, Ace-30, John, said, said, ljmanini, nobody2018, J4de, ckksec, 0xnev and SpicyMeatball.
Trading in the RubiconMarket has associated fee costs that are paid by the taker of the offer. These fees include the protocol fee and a new maker fee introduced in v2. Fees are pulled from the taker (caller of the function) independently of the trade amount, which means fees are not included in the trade amount. These are implemented in the buy function of the base contract SimpleMarket:
https://github.com/code-423n4/2023-04-rubicon/blob/main/contracts/RubiconMarket.sol#L337-L373
One of the new additions in the RubiconMarket v2 is fee inclusivity, a feature that would allow users to operate on the market by including the fee directly in the specified amount. This is present in different places of the contract, but the core implementation can be founded in the calcAmountAfterFee function:
https://github.com/code-423n4/2023-04-rubicon/blob/main/contracts/RubiconMarket.sol#L578-L589
As we can see in the previous snippet, the function calculates the protocol feeand the marker fee based on the given amount, and substacts those values from the amount. This is an inaccurate calculation, as these fees later on will be calculated using this new value, which wont end up totalling the requested original amount. As an example, lets consider the case of 100 tokens, a 10% protocol fee and a 5% maker fee:
In the following test, Alice makes an offer to sell 30k USDC for 1 BTC. Bob will execute the trade to buy the complete 30k USDC with BTC. However, as the fee calculation is inaccurate, the trade will be executed for an amount less than expected and Bob will be left with some unspent BTC (0.000225 BTC).
Note: the snippet shows only the relevant code for the test. Full test file can be found here.
The correct calculation for the fee inclusivity amount should be as follows:
For the example given in the previous section, this would result in an amount of 1000 / (100% + 10% + 5%) = 869.
daoio (Rubicon) confirmed
HickupHH3 (judge) commented:
HickupHH3 (judge) commented:
