# getDepositFeeInBNB() assumes a stablecoin price of 1 USD, which may not be true if it depegs Low/Info · Three Sigma · DeFi infrastructure · 10th November, 2023 Finding 3S-Clip Finance-L02 of the Clip Finance Strategies security review. - Protocol: https://www.clip.finance/ - Report: /reports/clip-finance-i - Source: https://cdn.sanity.io/files/qoqld077/production/c23d04c8223879d2443221caf3ccb55ac118441a.pdf --- ### Description In Batch.sol, function [`getDepositFeeInBNB()`](https://github.com/ClipFinance/strategy-router/blob/master/contracts/Batch.sol#L185) calculates the fee amount in BNB, considering that the stablecoin price is 1 USD, which may not be true, as we've seen with USDC in the past. It also means that if a coin other than a stablecoin is used to deposit, a much smaller/larger fee would be triggered. For example, 20 tokens are deposited, the fee is 10%, so 2 fee amount. The token price is 10 USD. The bnb price is 250 USD. The fee amount in BNB would be 2/250 = 0.008. So the user would deposit 20 tokens, worth 200 USD and pay a fee of 0.008 BNB or 2 USD, which is 2/200 = 1%, instead of 10%. The real fee, according to the code, is depositFee/(token price in USD). ### Recommendation Consider fetching the price of BNB in units of the to be deposited token. This way, the fee in the code will match the real percentage in USD. ### Status Acknowledged --- Related findings: - [_getPriceToTick() reverts if the price is smaller than 1e10, which may happen in _search() as it assumes the final tick as going entirely to the amm](https://0xsimao.com/findings/nftperp-i-price-reverts-happen-entirely): Nftperp Exchange