No way for governance to properly update feeProtocolNum
and feeProtocolDen
#252
Labels
2 (Med Risk)
Assets not at direct risk, but function/availability of the protocol could be impacted or leak value
bug
Something isn't working
🤖_primary
AI based primary recommendation
sufficient quality report
This report is of sufficient quality
Lines of code
https://github.com/ronin-chain/katana-v3-contracts/blob/03c80179e04f40d96f06c451ea494bb18f2a58fc/src/core/KatanaV3Factory.sol#L105
https://github.com/ronin-chain/katana-v3-contracts/blob/03c80179e04f40d96f06c451ea494bb18f2a58fc/src/core/KatanaV3Factory.sol#L123
https://github.com/ronin-chain/katana-v3-contracts/blob/03c80179e04f40d96f06c451ea494bb18f2a58fc/src/core/KatanaV3Pool.sol#L253
https://github.com/ronin-chain/katana-v3-contracts/blob/03c80179e04f40d96f06c451ea494bb18f2a58fc/src/core/KatanaV3Pool.sol#L261-L262
Vulnerability details
Proof of Concept
feeProtocolNum
andfeeProtocolDen
cannot be updated inslot0
struct if needed by pool governance due to an equivalent function not being available, and if done through factory, will not register in the struct leading to operations being conducted with stale parameters.There's no equivalent function to update the feeProtocolAmounts causing that
feeProtocolNum
andfeeProtocolDen
cannot be directly updated in the pool (unlike can be done in uniswap).Although, KatanaV3Factory has the
enableFeeAmount
which allows the owner to set, or potentially update thefeeProtocolNum
andfeeProtocolDen
parameters,the update, while registered in the factory will not be updated in the
slot0
struct and as a result, pool operations will still be conducted based on the previous stalefeeProtocolNum
andfeeProtocolDen
.Recommended Mitigation Steps
Add a relevant governance function to update the
feeAmountProtocol
inslot0
based on the enabled feeAmount. Or introduce a stand-alone function similar to uniswap'ssetFeeProtocol
Assessed type
Context
The text was updated successfully, but these errors were encountered: