Yieldy contest - sseefried's results

Lines of code

https://github.com/code-423n4/2022-06-yieldy/blob/524f3b83522125fb7d4677fa7a7e5ba5a2c0fe67/src/contracts/Staking.sol#L167-L170

Vulnerability details

Impact

One could set the fee to anything. If it was set to 100% all incoming Tokemak rewards would be sent with _sendAffiliateFee. If it was higher, it would send also send reserves of TOKE (which would eventually fail due to a lack of reserves).

The setting of a high fee doesn't just allow rug pulling by the owner, it could also happen by mistake and cause users to lose valuable rewards.

Proof of Concept

See code of _sendAffiliateFee on lines 129-134.

Tools used

Manual Inspection

Recommended Mitigation Steps

Create a new constant called MAX_AFFILIATE_FEE and ensure that fee can't be set higher.

e.g.

uint256 public constant MAX_AFFILIATE_FEE = 1000; // 10% in basis points

function setAffiliateFee(uint256 _affiliateFee) external onlyOwner {
    require(_affiliateFee < MAX_AFFILIATE_FEE, "Fee too high");
    affiliateFee = _affiliateFee;
    emit LogSetAffiliateFee(block.number, _affiliateFee);
}