A commission_fee is charged when depositing assets to CollateralTracker via deposit()

[c4-bot-6]

Lines of code

https://github.com/code-423n4/2024-04-panoptic/blob/main/contracts/CollateralTracker.sol#L399-L408
https://github.com/code-423n4/2024-04-panoptic/blob/main/contracts/CollateralTracker.sol#L1096-L1126

Vulnerability details

Impact

Each time user go for collateral deposit he subject to pay a COMMISSION_FEE. Its get more difficult for user when he try to save himself from liquidation and add collateral, some of its fund moved as a commision fee

Proof of Concept

Here Deposit function as follows

    function deposit(uint256 assets, address receiver) external returns (uint256 shares) { 
        if (assets > type(uint104).max) revert Errors.DepositTooLarge();

        shares = previewDeposit(assets); 
.....
.....

        emit Deposit(msg.sender, receiver, assets, shares);
    }

which calls previewDeposit() which is implemented as follows

    function previewDeposit(uint256 assets) public view returns (uint256 shares) {
...
...
        unchecked {
            shares = Math.mulDiv(
                assets * (DECIMALS - COMMISSION_FEE), 
                totalSupply,
                totalAssets() * DECIMALS
            );
        }
    }

But point is if you goes to Developer code comment on COMMISSION_FEE which says following

    /// @notice when creating an option, collect a commission for the Panoptic LPs.
    /// In Panoptic, options never expire, commissions are only paid when a new position is minted.
    /// We believe that this will eliminate the impact of the commission fee on the user's decision-making process when closing a position.
    uint256 immutable COMMISSION_FEE;  

And docmentation also clear that COMMISSION_FEE only applied when new option created(minted), not when asset deposited. below are links

https://panoptic.xyz/docs/panoptic-protocol/specs#commission-fee
https://panoptic.xyz/docs/panoptic-protocol/commission

This also implemented in _getExchangedAmount() which returns exchangedAmount The amount of funds to be exchanged for minting an option (includes commission, swapFee, and intrinsic value).

    function _getExchangedAmount(
        int128 longAmount,
        int128 shortAmount,
        int128 swappedAmount
    ) internal view returns (int256 exchangedAmount) {
...
...

            //compute total commission amount = commission rate + spread fee
            exchangedAmount += int256(
                Math.unsafeDivRoundingUp(
                    uint256(uint128(shortAmount + longAmount)) * COMMISSION_FEE,
                    DECIMALS
                )
            );
        }
    }

So problem here is that protocol charging fee on each deposit, although there is no mention of it.

Tools Used

Manual Review

Recommended Mitigation Steps

As per code comments & Documentation, Panoptic should only charge COMMISSION_FEE when new position minted not in every collateral deposit.

Assessed type

Other

[Picodes]

It seems to be working as designed

[c4-judge]

Picodes changed the severity to QA (Quality Assurance)