037.md

Tiny Mulberry Buffalo

Medium

Fee inconsistency between buying and selling results in inaccurate fees collected

Summary

Currently, fees between selling and buying are taken differently. When buying, fees are based on just the buying amount, while when selling, their based on the entire amount.

  function previewEntryFees(
    uint256 fundsBeforeFees
  ) private view returns (uint256 totalCostIncludingFees, uint256 protocolFee, uint256 donation) {
    protocolFee = (fundsBeforeFees * entryProtocolFeeBasisPoints) / BASIS_POINTS_BASE;
    donation = (fundsBeforeFees * donationBasisPoints) / BASIS_POINTS_BASE;
    totalCostIncludingFees = fundsBeforeFees + protocolFee + donation;
  }

  function previewExitFees(
    uint256 proceedsBeforeFees
  ) private view returns (uint256 totalProceedsAfterFees, uint256 protocolFee) {
    protocolFee = (proceedsBeforeFees * exitProtocolFeeBasisPoints) / BASIS_POINTS_BASE;
    totalProceedsAfterFees = proceedsBeforeFees - protocolFee;
  }

In other words, if a user wants to buy votes worth 1 ETH, and fee is 5%, user would have to pay 1.05 ETH, which makes the actual fee 4.76% However, when selling tokens worth 1 ETH, and the fee is again 5%, they'd receive 0.95 ETH. In this case, the 5% fee is correct.

Root Cause

Wrong math calculation

Affected Code

https://github.com/sherlock-audit/2024-12-ethos-update/blob/main/ethos/packages/contracts/contracts/ReputationMarket.sol#L1109

Impact

Wrong fee taken

Mitigation

Change the formula when calculating fees when buying.