Description

To swap an _amountIn of ETH or tokens, the user has to pay a swap fee. The fee calculation is done as follows:

fee = (_amountIn * $.config.tradeFeeBps) / WEI6;

In Solidity, if the amount is less than WEI6 / $.config.tradeFeeBps, the fee is rounded down to zero.

Impact

It may be economical for a user to deploy a contract that repeatedly purchases a small amount of tokens, instead of executing a large purchase all at once, to avoid the trade fee. If they do this, the user will pay more gas, but this gas may be cheaper than the fee, depending on the size of the tradeFeeBps parameter.

Recommendations

The division by WEI6 should round up, instead of down. Alternatively, ensure that tradeFeeBps is always low enough that the gas needed per trade size to exploit this rounding error is more expensive than just paying the fee.

Remediation

This issue has been acknowledged by PondFun, and a fix was implemented in commit 07f6d3ea↗.