PNS - Loss Calculation Bug in Request Execution

[sherlock-admin2]

PNS

Medium

Loss Calculation Bug in Request Execution

Summary

The protocol incorrectly calculates the loss incurred during the execution of a request. As a result, the protocol will not be able to accurately track its losses.

Vulnerability Detail

he GasProcess:processExecutionFee() function is used to calculate and verify how much the user has paid for executing a request. If the paid amount is less than the actual gas cost, the protocol records a loss. However, due to the incorrect order of operations, the loss is always zeroed out.

File: contracts/process/GasProcess.sol
22:         if (executionFee > cache.userExecutionFee) {
23:             executionFee = cache.userExecutionFee;
24:             lossFee = executionFee - cache.userExecutionFee; //@audit always 0
25:         } else {

The current logic sets executionFee to cache.userExecutionFee before calculating lossFee, which results in lossFee always being zero.

Impact

The protocol will not correctly record the loss, leading to inaccurate financial tracking and potential mismanagement of funds.

Code Snippet

• GasProcess.sol

Tool used

Manual Review

Recommendation

hange the order of operations to correctly calculate the loss before updating the executionFee.

        if (executionFee > cache.userExecutionFee) {
+           lossFee = executionFee - cache.userExecutionFee;
            executionFee = cache.userExecutionFee;
-           lossFee = executionFee - cache.userExecutionFee;
        } else {

This adjustment ensures that lossFee is calculated based on the original executionFee before it is modified to match cache.userExecutionFee.

Duplicate of #108