Summary
The taker fee is calculated in a wrong way leading to an underestimation of the fee.
Vulnerability Detail
The taker fee is calculated by picking up the maker amount and multiplying by (1 + fee). The maker amount is the amount the user receives. Consider the following example: Assume that the ratio between the maker and taker assets is the same. The taker wants a making amount of 1000, paying a fee of 1000 * 10% = 100, so the taking amount is 1100. This means that effectively, the taker pays a fee of 100 / 1100 = 9.1%`, as they pay 1100 and receive 1000.
Same goes for the inverse calculation.
Impact
Fee is smaller than intended.
Code Snippet
Tool Used
Manual Review
Recommendation
The correct implementations are:
takingAmount = makerAmount / (1 - feeRate)
makerAmount = takingAmount * (1 - feeRate)