# Taker fee is underestimated due to incorrect fee calculation Low/Info · Sherlock · DEX aggregator · 14th April, 2025 Finding L-1 of the 1inch Fee Extension security review. - Protocol: https://1inch.com/ - Report: /reports/1inch - Source: https://github.com/1inch/1inch-audits/blob/master/Fees%20for%20LO%20and%20Fusion%20V1/Fee%20flow%20v1-Sherlock.pdf --- ## Summary The taker fee is calculated in a wrong way leading to an underestimation of the fee. ## Vulnerability Detail The taker fee is calculated by picking up the maker amount and multiplying by (1 + fee). The maker amount is the amount the user receives. Consider the following example: Assume that the ratio between the maker and taker assets is the same. The taker wants a making amount of 1000, paying a fee of `1000 * 10% = 100`, so the taking amount is 1100. This means that effectively, the taker pays a fee of `100 / 1100` = 9.1%`, as they pay 1100 and receive 1000. Same goes for the inverse calculation. ## Impact Fee is smaller than intended. ## Code Snippet https://github.com/sherlock-audit/2025-04-1inch/blob/main/limit-order-protocol/contracts/extensions/AmountGetterWithFee.sol#L33-L37 https://github.com/sherlock-audit/2025-04-1inch/blob/main/limit-order-protocol/contracts/extensions/AmountGetterWithFee.sol#L55-L60 ## Tool Used Manual Review ## Recommendation The correct implementations are: ```Solidity takingAmount = makerAmount / (1 - feeRate) makerAmount = takingAmount * (1 - feeRate) ``` --- Related findings: - [Vault portion calculation in `PrizePool::getVaultPortion()` is incorrect as `_startDrawIdInclusive` has been erased](https://0xsimao.com/findings/pooltogether-the-prize-layer-for-defi-portion-prize-inclusive-erased): PoolTogether Prize Layer - [Incorrect withdraw queue balance in TVL calculation](https://0xsimao.com/findings/renzo-withdraw-queue-tvl-calculation): Renzo - [Incorrect initial deposit calculation may cause cancelProgram to revert](https://0xsimao.com/findings/superfluid-locker-system-ii-initial-deposit-program-revert): Superfluid Locker Pumponomics - [Program start failure due to incorrect buffer calculation](https://0xsimao.com/findings/superfluid-locker-system-ii-program-start-failure-buffer): Superfluid Locker Pumponomics