Skip to content

Latest commit

 

History

History
27 lines (18 loc) · 838 Bytes

009.md

File metadata and controls

27 lines (18 loc) · 838 Bytes

Proud Rusty Mantis

High

Buy fee changes incorrectly

Vulnerability Detail

For every 1$ of NUMA/nuAsset being minted/burned, the fee should increase/decrease. This can be confirmed by the docs:

For every $1 of $NUMA minted via the vault, the buy fee increases by 0.0001%.

Let's we take a look at the code implementation:

uint buyPID_adj = (ethAmount * buyPID_incAmt) / (1 ether);

ethAmount is the NUMA amount in ETH. This means that the buy fee is adjusting based on the ETH value instead of based on each 1$.

Attack Path

  1. Buy fee is supposed to change 0.0001% for every 1$ of NUMA
  2. It instead changes on every ETH, if 1 ETH is 3000$, then the fee would change 0.0001% instead of 0.3%

Impact

Incorrect buy fee

Mitigation

Adjust the fee based on the dollar value, not ETH value