flashFee() missing multiplied by some exponent depending on the base token decimals.

[code423n4]

Lines of code

https://github.com/code-423n4/2023-04-caviar/blob/cd8a92667bcb6657f70657183769c244d04c015c/src/PrivatePool.sol#L750

Vulnerability details

Impact

flashFee() missing multiplied by some exponent depending on the base token decimals.
When execute flashLoan() fee will undercharged

Proof of Concept

When the changeFeeQuote() is calculated, it is performed multiplied by some exponent depending on the base token decimals.

    /// @notice Returns the fee required to change a given amount of NFTs. The fee is based on the current changeFee
    /// (which contains 4 decimals of precision) multiplied by some exponent depending on the base token decimals.
    /// @param inputAmount The amount of NFTs to change multiplied by 1e18.
    /// @return feeAmount The fee amount.
    /// @return protocolFeeAmount The protocol fee amount.
    function changeFeeQuote(uint256 inputAmount) public view returns (uint256 feeAmount, uint256 protocolFeeAmount) {
        // multiply the changeFee to get the fee per NFT (4 decimals of accuracy)
        uint256 exponent = baseToken == address(0) ? 18 - 4 : ERC20(baseToken).decimals() - 4;
        uint256 feePerNft = changeFee * 10 ** exponent;

        feeAmount = inputAmount * feePerNft / 1e18;
        protocolFeeAmount = feeAmount * Factory(factory).protocolFeeRate() / 10_000;
    }

but in flashFee() only return changeFee

    function flashFee(address, uint256) public view returns (uint256) {
        return changeFee;
    }

missing multiplied by some exponent depending on the base token decimals.

Tools Used

Recommended Mitigation Steps

    function flashFee(address, uint256) public view returns (uint256) {
-       return changeFee;
+       uint256 exponent = baseToken == address(0) ? 18 - 4 : ERC20(baseToken).decimals() - 4;
+       return changeFee * 10 ** exponent;
    }

[c4-pre-sort]

0xSorryNotSorry marked the issue as duplicate of #864

[c4-judge]

GalloDaSballo marked the issue as satisfactory