Pre-auditThree days of senior audit time for $1,500, credited in full toward your Zealynx audit.3 audit days, credited toward your auditSee how →
L-11·

Unbounded protocol fee issue in `setProtocolFees()`

Not reportedoptionsleverageblack-scholes
TL;DR

The setProtocolFees function in AdminOperationalTreasury allows the admin to set protocol fees without any maximum cap or constraints:

Severity
LOW
Method
MManual review
CAT.

The setProtocolFees function in AdminOperationalTreasury allows the admin to set protocol fees without any maximum cap or constraints:

solidity
function setProtocolFees(uint24 protocolFees_) external onlyRole(AccessControlStorage.DEFAULT_ADMIN_ROLE) {
OperationalTreasuryStorage.BaseSetUp storage baseSetUp = OperationalTreasuryStorage.layout().setUp.base;
emit ProtocolFeesSet(baseSetUp.protocolFees, protocolFees_);
baseSetUp.protocolFees = protocolFees_;
}

This introduces two vulnerabilities:

  1. The admin can set the fee to 100% (or more), enabling the protocol to transfer the entire user allowance when calling _takeFeesLockLiquidity to transfer fee+premium from the user buying the option.
  2. Similarly, during payOff, the admin could configure the fee to absorb all user PnL as protocol revenue.
02Section · Report provenance

Report provenance

Published by Pashov Audit Group, with Carlos (Bloqarl) participating as a contractor. The source report states that its fixes review was not fully completed; no final remediation disposition is recorded for this finding. Read the full report.

L-11