L-11·
Unbounded protocol fee issue in `setProtocolFees()`
TL;DR
The setProtocolFees function in AdminOperationalTreasury allows the admin to set protocol fees without any maximum cap or constraints:
Severity
LOW
Method
MManual review
CAT.
The setProtocolFees function in AdminOperationalTreasury allows the admin to set protocol fees without any maximum cap or constraints:
solidity
function setProtocolFees(uint24 protocolFees_) external onlyRole(AccessControlStorage.DEFAULT_ADMIN_ROLE) {OperationalTreasuryStorage.BaseSetUp storage baseSetUp = OperationalTreasuryStorage.layout().setUp.base;emit ProtocolFeesSet(baseSetUp.protocolFees, protocolFees_);baseSetUp.protocolFees = protocolFees_;}
This introduces two vulnerabilities:
- The admin can set the fee to 100% (or more), enabling the protocol to transfer the entire user allowance when calling
_takeFeesLockLiquidityto transfer fee+premium from the user buying the option. - Similarly, during
payOff, the admin could configure the fee to absorb all user PnL as protocol revenue.
02Section · Report provenance
Report provenance
Published by Pashov Audit Group, with Carlos (Bloqarl) participating as a contractor. The source report states that its fixes review was not fully completed; no final remediation disposition is recorded for this finding. Read the full report.