# Anyone can frontrun a relayer interaction with the same arguments but a much higher/lower relayer fee Crit/High · Three Sigma · Private DeFi access · 26th February, 2024 Finding 3S-SG-H09 of the Singularity security review. - Protocol: https://www.thesingularity.network/ - Report: /reports/singularity - Source: https://cdn.sanity.io/files/qoqld077/production/45b8aac56a2b8e3b557df4329ac9bf8220b64012.pdf --- ### Description The relayer fee used throughout the codebase is not enforced [anywhere](https://github.com/portalgateme/darkpool-v1-zk-contracts-fork/commit/caed73d878d323b218fbef82094264528478c61f), such that it's possible to frontrun a legit transaction and set a much lower/higher relayer fee, harming the relayer/user. ### Recommendation There are several ways to tackle this issue: 1. Assert that the relayer is the msg.sender. 2. Place a cap on the relayer fee. 3. The relayer gas fee could be part of the message that the user signs. ### Status Addressed in [#99f0220](https://github.com/portalgateme/darkpool-v1-zk-contracts-fork/commit/99f0220f4ab747bd2d8aeaf2fa754b47b7fa7815), [#02e5da2](https://github.com/portalgateme/darkpool-v1-zk-contracts-fork/commit/02e5da2e2961d3515a4c91af3a5a591ef11e38df). --- Related findings: - [_handleSwapAction(...) creates situations where the arguments receiver and sweeper need to be the same address in BaseRouter](https://0xsimao.com/findings/fuji-finance-handle-creates-situations-sweeper): Fuji Finance - [Setting maxFundingFeePerBlock to a lower value than abs(lastFundingRate) will brick getPendingAccFundingFees()](https://0xsimao.com/findings/ostium-fee-abs-brick-fees): Ostium - [`GlobalVariables::oftOrCollateralReceiveFromOtherChains()` calculates the fee as if it was the same in both chains, which is false](https://0xsimao.com/findings/autonomint-collateral-calculates-fee-both): Autonomint