Skip to content

Important: hackathon fees may not be collected (config drift) #27

@0xdevcollins

Description

@0xdevcollins

Severity: Important (revenue)

core_escrow.FeeConfig defines hackathon_fee_bps: 400 (4%), but create_hackathon calls core_escrow.create_pool directly — no fee path visible. Crowdfund uses route_pledge which IS fee-aware. Hackathons appear to bypass fee collection.

Action

  1. Confirm whether the platform currently collects fees on hackathons.
  2. If yes: trace where the deduction happens and document.
  3. If no: decide product question — should hackathons have a creator fee? If yes, add fee path before mainnet.

Tests (if fee added)

  • 1000 USDC pool creation deducts 40 USDC to treasury, 960 to pool
  • Fee config update reflected in subsequent creates
  • No fee on cancellation refund

Metadata

Metadata

Assignees

No one assigned

    Labels

    audit-findingSurfaced during internal audit / reviewquestionFurther information is requested

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions