PuttyV2.withdraw() might revert with zero transfer.

[code423n4]

Lines of code

https://github.com/code-423n4/2022-06-putty/blob/3b6b844bc39e897bd0bbb69897f2deff12dc3893/contracts/src/PuttyV2.sol#L499-L500

Vulnerability details

Impact

PuttyV2.withdraw() might revert with zero transfer.
So users can't withdraw their funds and tokens.

Proof of Concept

As we can check from previous issue, some ERC20 tokens don't allow transfer of 0 amount.
And when we calculate feeAmount, feeAmount might be zero even though the fee is positive when order.strike is less than 1000.
Then the fee transfer might revert and users can't withdraw their funds and tokens.

Tools Used

Solidity Visual Developer of VSCode

Recommended Mitigation Steps

We can modify this part like below.

uint256 feeAmount = (order.strike * fee) / 1000;
if (feeAmount != 0) {
    ERC20(order.baseAsset).safeTransfer(owner(), feeAmount);
}

[outdoteth]

Duplicate: withdraw() can be DOS’d for baseAsset ERC20s that prevent 0 transfers if the calculated feeAmount is 0 due to rounding: #283