Attacker can swap wBTC in the DeliHook multiples times to not pay / pay less swap fees

Summary

DeliHook::_beforeSwap() rounds down the baseFeeSpecified instead of rounding up, allowing an attacker to abuse the low gas fees on Base and the high btc price to not pay any fees (or half).

The attacker swaps in a pool with the DeliHook and wBTC, with a fee of for example 300 (0.03%). For a wBTC amount of 3000 wei or 3 USD, baseFeeSpecified = 3000 * 300 / 1e6 = 0.9 = 0, and the user pays 0. If a 0 fee is problematic for any reason, the attacker can specify 6000 wei, and still save 1 wBTC due to rounding down each time.

The attack is economic viable because 1 wei of wBTC = 1 * 100_000 / 1e8 = 0.001 USD, and the gas cost of a single swap, when bundled together to optimize hot storage, is many times smaller. As an example, a sample swap takes a fee of 0.001566 USD, without using the hot storage properties nor fixed costs, and is already close to profitability. If swaps are made in a loop, the gas price of each swap will go down a lot due to not having fixed tx costs and hot storage loading, making the attack viable. In times of lower gas usage, it is even more profitable.

This causes a 100% fee loss for users of the protocol, hence high severity.

Note: it should also round up when converting the baseFeeSpecified to the fee currency, when needed.

Root Cause

DeliHook.sol:231 rounds down instead of up.

Internal Pre-conditions

None

External Pre-conditions

None

Attack Path

1. Attacker swaps in a loop wBTC, paying 1 less wBTC each time due to rounding down, so the lps (FeeProcessor, DailyEpochGauge) receive much less fees.

Impact

A single attacker can cause a significant loss, if all users do this, they would eliminate all lp fees, or very significantly reduce them, and it is profitable.

PoC

See above.

Mitigation

Round up the fee.