<!-- canonical: https://0xsimao.com/findings/teller-finance-497-bid-fee-audit -->

# Issue #497 'Add parameter to lender accept bid for MaxMarketFee' from previous audit is still present

Medium · Sherlock · Lending · 23rd April 2024

Finding M-10 of the Teller Finance competition.

- Protocol: https://audits.sherlock.xyz/contests/295
- Codebase: https://github.com/0xsimao/2024-04-teller-finance/tree/defe55469a2576735af67483acf31d623e13592d
- Source: https://github.com/sherlock-audit/2024-04-teller-finance-judging/issues/125

---

## Summary

Issue [#497](https://github.com/sherlock-audit/2023-03-teller-judging/issues/497) from the previous Sherlock audit was not fixed in the current code and is still present.

## Vulnerability Detail

The vulnerability is well explain in the mentionedl link above, essentially any market owner may change the marketplace fee while frontrunning a borrower and getting more funds in return.

A PR with the fix was mentioned in the comments but it was never [merged](https://github.com/teller-protocol/teller-protocol-v2/pull/81/files).

From the [docs](https://docs.sherlock.xyz/audits/judging/judging), the issue is valid as long as there is not a `won't fix` label.

## Impact

Borrower pays more marketplace fees than expected due to malicious market owner.

## Code Snippet

[TellerV2::lenderAcceptBid()](https://github.com/sherlock-audit/2024-04-teller-finance/blob/main/teller-protocol-v2-audit-2024/packages/contracts/contracts/TellerV2.sol#L481)
```solidity
function lenderAcceptBid(uint256 _bidId)
    ...
{
    ...
    amountToMarketplace = bid.loanDetails.principal.percent(
        marketRegistry.getMarketplaceFee(bid.marketplaceId)
    ...
}
```

## Tool used

Manual Review

Vscode

## Recommendation

The recommendation from issue [#497](https://github.com/sherlock-audit/2023-03-teller-judging/issues/497) are good:
> Add a timelock delay for setMarketFeePercent/setProtocolFee
   allow lenders to specify the exact fees they were expecting as a parameter to lenderAcceptBid

---

Related findings:

- [mTapiocaOFT can't be rebalanced because the Balancer in tapiocaz-audit calls swapETH() or swap() of the RouterETH but does not forward ether for the message fee](https://0xsimao.com/findings/tapioca-dao-rebalanced-balancer-eth-fee): Tapioca DAO
- [Missing documentation for MapleLoan, SetPendingLender and AcceptLender being implemented on MapleLoan but not on LoanManager.](https://0xsimao.com/findings/maple-finance-iii-documentation-pending-accept-implemented): Maple Finance
- [Protocol fee from Market.sol is locked](https://0xsimao.com/findings/perennial-v2-fee-market-sol-locked): Perennial V2
- [Setting maxFundingFeePerBlock to a lower value than abs(lastFundingRate) will brick getPendingAccFundingFees()](https://0xsimao.com/findings/ostium-fee-abs-brick-fees): Ostium