Description

The receiveUSDCFromTrader function has a parameter for vault fees in the implementation of the function:

function _receiveUSDCFromTrader(address _trader, uint _amount,
uint _vaultFee) internal {
    storageT.transferUSDC(address(storageT), address(this), _amount);

    if (_vaultFee > 0) totalRewards += _vaultFee;
    emit USDCReceivedFromTrader(_trader, _amount, _vaultFee);
}

The vault fee is not taken from the user; it is only allocated as a reward. This means that the function expects the caller to be responsible for transferring the vault fee, which is confusing because this function is responsible for transferring the collateral itself.

Impact

There is no impact because this function is only ever called with a zero vault fee.

Recommendations

We recommend either removing this parameter altogether or adding it to the amount of USDC transferred from storage so that future changes are less likely to create issues.

Remediation

This issue has been acknowledged by Avantis Labs, Inc., and a fix was implemented in commit f8af8cb2↗.