Omniscia Alliance Block Audit
SessionPaymentPortal Manual Review Findings
SessionPaymentPortal Manual Review Findings
SPP-01M: Incorrectly Calculated TKN Amount
Type | Severity | Location |
---|---|---|
Logical Fault | SessionPaymentPortal.sol:L123 |
Description:
The calculateUSDTtoTKN
function call within payTKN
will incorrectly assume a Uniswap fee is meant to be deducted thus producing a number lower than it should be.
Impact:
Incorrect payment calculations for the session access purchase will cause reduced revenue for the session access provider.
Example:
contracts/session/SessionPaymentPortal.sol
99/// User pays for their session by providing some data that binds the100/// payment to the session somehow offchain.101/// @param paymentConfig_ Must be the same payment config hashed during102/// construction of the contract.103/// @param maxTKN_ User can set a maximum TKN that they are willing to104/// pay for the transaction. As the price is converted by USDT to TKN by105/// the oracle it is possible for the exchange rate to move against the106/// user while the transaction is being mined. If the TKN amount exceeds107/// the limit the transaction will rollback.108/// @param data_ The session data that binds the payment to the session.109/// The offchain handling MUST be secure despite the session data being110/// completely public in the associated `SessionPaid` event. This can be111/// achieved (for example) by having the `msg.sender` sign a request for112/// a session key separate to the public session ID in `data_`. This way113/// the offchain consumer knows that the payer and session key requestor114/// are the same entity.115function payTKN(116 PaymentConfig calldata paymentConfig_,117 uint256 maxTKN_,118 bytes calldata data_119) external onlyValidPaymentConfig(paymentConfig_) {120 emit SessionPaid(msg.sender, data_);121
122 // Process payment.123 uint256 tknAmount_ = calculateUSDTtoTKN(paymentConfig_.usdtPrice);124 require(tknAmount_ <= maxTKN_, "SessionPaymentPortal: MAX_TKN");125 SplitPayment.splitTransfer(126 paymentConfig_.tkn,127 msg.sender,128 tknAmount_,129 paymentConfig_.shares130 );131}
Recommendation:
We advise an alternative oracle measurement to be utilized here instead allowing the full TKN amount to be extracted by the payer as it currently causes an additional unintended incentive to pay with TKNs for the subscription.
Alleviation:
The fee is no longer applied at the USDTTKNPriceOracle
level thus alleviating this exhibit in full.