Skip to content
Request an audit

‹ All findings

Users always pay fee on the full swapped amount in the DeliHook, even if the swap is smaller

MediumBMX·Sherlock · Perpetuals DEX · 2nd September 2025M-4

Source

Summary

Users can specify a price limit in their swap, limiting the amount of funds actually swapped, or there may not be enough assets of one of the tokens to swap. The DeliHook doesn't take this into account, always paying fee over the full amount specified, overcharging the user by a very significant amount, link.

Root Cause

In DeliHook.sol:231, the fee is always calculated on the full input amount, regardless of the actual amount swappd.

Internal Pre-conditions

None.

External Pre-conditions

None.

Attack Path

  1. User does a swap, specifying a sqrt limit price that will be hit without using the full input/output amount. Or, alternatively, the pool runs out of one of the tokens.
  2. DeliHook will apply the fee on the full input amount, instead of just the amount swapped, link to where the fee is applied.

Impact

If the user specifies a sqrtPrice limit that only swaps 50% of the input/output funds, and the fee is calculated on 100% of the amount, it would be an error of 100%, high severity, and scales with the amount swapped.

PoC

None

Mitigation

Adjust the fee for the actual amount swapped.