Creator fee calculation bypass in _getCreatorFee can lead to unexpected fees on zero supply

[howlbot-integration]

Lines of code

https://github.com/code-423n4/2024-08-phi/blob/8c0985f7a10b231f916a51af5d506dd6b0c54120/src/curve/BondingCurve.sol#L128-L151

Vulnerability details

Impact

The _getCreatorFee function allows the creator fee calculation to bypass the zero supply check. As a result, unexpected creator fees being charged when the supply is zero, contradicting the behavior as seen in other parts of the codebase.

POC

Consider the _getCreatorFee function:

function _getCreatorFee(
    uint256 credId_,
    uint256 supply_,
    uint256 price_,
    bool isSign_
)
    internal
    view
    returns (uint256 creatorFee)
{
    if (!credContract.isExist(credId_)) {
        return 0;
    }
    if (supply_ == 0) {
        creatorFee = 0;
    }

    (uint16 buyShareRoyalty, uint16 sellShareRoyalty) = credContract.getCreatorRoyalty(credId_);

    uint16 royaltyRate = isSign_ ? buyShareRoyalty : sellShareRoyalty;
    creatorFee = (price_ * royaltyRate) / RATIO_BASE;
}

The function sets creatorFee = 0 when supply_ == 0, but it doesn't return immediately. Instead it continues execution and calculates a new creatorFee value based on the royaltyRate, potentially overwriting the zero value.

This means that even when the supply is zero, a creator fee might still be charged, which is likely not the intended behavior based on this part of the code in the getPriceData function that sets creator fee to 0 when supply is 0.

Tools Used

None

Recommended Mitigation Steps

Consider modifying the _getCreatorFee function to return immediately when supply_ == 0

function _getCreatorFee(
    uint256 credId_,
    uint256 supply_,
    uint256 price_,
    bool isSign_
)
    internal
    view
    returns (uint256 creatorFee)
{
    if (!credContract.isExist(credId_)) {
        return 0;
    }
    if (supply_ == 0) {
-       creatorFee = 0;
+       return 0;
    }

    (uint16 buyShareRoyalty, uint16 sellShareRoyalty) = credContract.getCreatorRoyalty(credId_);

    uint16 royaltyRate = isSign_ ? buyShareRoyalty : sellShareRoyalty;
    creatorFee = (price_ * royaltyRate) / RATIO_BASE;
}

Assessed type

Context

[c4-judge]

fatherGoose1 changed the severity to QA (Quality Assurance)

[c4-judge]

fatherGoose1 marked the issue as grade-a

[fatherGoose1]

Valid issue, but only affects calculations on the frontend.