In init() it is not checked if the fees are in the accepted range

[hats-bug-reporter]

Github username: --
Twitter username: --
Submission hash (on-chain): 0x95ab7ec3aa88b33a4b882ebdfc0724a2439bedd0ea7e3482af39762cdb92f1ad
Severity: low

Description:
Description
In init function the default fees values are set.

Later these fees can be updated with setEntryFee, setExitFee, setProtocolFee. Inside these functions, there is a check that ensures the fee value is not more than the max.

 if (exitFee > maxExitFeePercentage) {
            revert Errors.MultiVault_InvalidExitFee();
        }

There is no such check in the init function when setting the default fees.

Attack Scenario
Describe how the vulnerability can be exploited.

Attachments

1. Proof of Concept (PoC) File

2. Revised Code File (Optional)

+     uint256 maxFeePercentage = generalConfig.feeDenominator / 10;
+
+      if ( _defaultVaultFees.entryFee > maxFeePercentage) {
+            revert Errors.MultiVault_InvalidEntryFee();
+       }
+        
+        if (_defaultVaultFees.exitFee > maxFeePercentage) {
+            revert Errors.MultiVault_InvalidExitFee();
+        }
+
+        if ( _defaultVaultFees.protocolFee > maxFeePercentage) {
+            revert Errors.MultiVault_InvalidProtocolFee();
+        }

vaultFees[0] = VaultFees({
            // @audit not checked if the values are in the accepted range
            entryFee: _defaultVaultFees.entryFee,
            exitFee: _defaultVaultFees.exitFee,
            protocolFee: _defaultVaultFees.protocolFee
        });

[mihailo-maksa]

The report suggests that the init function does not check if default fee values are within an acceptable range.

Label: invalid

Comment:
Our deployment script has the fees and other key deployment parameters hardcoded, making it unnecessary to check for their specific values as part of the init method. This design choice prioritizes both gas savings and simplicity.

Comment on the issue:
Our deployment script has the fees and other key deployment parameters hardcoded, making it unnecessary to check for their specific values in the init method. This design prioritizes gas savings and simplicity.