Kuiper contest - gpersoon's results

Handle

gpersoon

Vulnerability details

Impact

The function changeLicenseFee() update the value for licenseFee. The next time handleFees() is call is uses the new version of licenseFee. However the previous time when handleFees() was called might be some time ago.

Now the new licenseFee is applied to a period in the past. This might lead to slightly inaccurate fees.

Proof of Concept

https://github.com/code-423n4/2021-12-defiprotocol/blob/205d3766044171e325df6a8bf2e79b37856eece1/contracts/contracts/Basket.sol#L177-L192

function changeLicenseFee(uint256 newLicenseFee) onlyPublisher public override {
      ...
            licenseFee = newLicenseFee;

https://github.com/code-423n4/2021-12-defiprotocol/blob/205d3766044171e325df6a8bf2e79b37856eece1/contracts/contracts/Basket.sol#L133-L153

function handleFees(uint256 startSupply) private {
    ...
            uint256 timeDiff = (block.timestamp - lastFee);
            uint256 feePct = timeDiff * licenseFee / ONE_YEAR;
            uint256 fee = startSupply * feePct / (BASE - feePct);
            _mint(publisher, fee * (BASE - factory.ownerSplit()) / BASE);
            _mint(Ownable(address(factory)).owner(), fee * factory.ownerSplit() / BASE);          

Tools Used

Recommended Mitigation Steps

Consider calling handleFees() at the beginning of changeLicenseFee()