_handleCloseFees returns a _payout that does not account for referral fees

[code423n4]

Lines of code

https://github.com/code-423n4/2022-12-tigris/blob/588c84b7bb354d20cbca6034544c4faa46e6a80e/contracts/Trading.sol#L805

Vulnerability details

Impact

Payout calculated on closing a trade accounts for daoFees, burnFees, botFees but misses referralFees. This means that payout to trader is higher than what it is supposed to be. Since the error concerns payments to users, I have classified it as High Risk finding

Payout is calculated in line 805 as follows

        payout_ = _payout - _daoFeesPaid - _burnFeesPaid - _botFeesPaid;

Above formula can also be written as

payout_ = _payout - (daoFeesPaid + burnFeesPaid + botFeesPaid)

Note that _daoFeesPaid variable in above formula has already accounted for

• 2*_referralFeesPaid that is already subtracted
• _botFeesPaid that is also subtracted

current formula adds back _botFeesPaid to daoFeesPaid but the 2*_referralPaid that was earlier subtracted from daoFeesPaid is not added -> so the payout_ computed will always be higher than the actual value

Recommended Mitigation Steps

Use formula below for line 805

payout_ = _payout - (daoFeesPaid + burnFeesPaid + botFeesPaid + 2* _referralFeesPaid);

[c4-judge]

GalloDaSballo marked the issue as duplicate of #476

[c4-judge]

GalloDaSballo marked the issue as satisfactory

[c4-judge]

GalloDaSballo marked the issue as duplicate of #367