Description

In the swap contract, the admin can call SetFeeRate to set a new fee rate:

public override Empty SetFeeRate(Int64Value input)
{
    AssertSenderIsAdmin();
    State.FeeRate.Value = input.Value;
    return new Empty();
}

However, there is no check on the input.

Impact

If the new fee rate is above FeeRateMax, then invariants are broken, since the charged fee would be larger than 100%. Similarly, if the fee rate is below zero, then other unintended and unchecked behavior may occur.

Recommendations

This admin function should have a guard on the range of the input.

Remediation

This issue has been acknowledged by Awaken Finance, and a fix was implemented in commit 1eeef4bf↗.