[Security] NLP Burn Minimum Fee Causes 100% Fund Loss for Small Positions

[mayur2811]

Summary

The burnNlp() function in Clearinghouse.sol enforces a minimum burn fee of 1e18 (1 full quote token), causing disproportionate losses for users with small NLP positions.

Severity: Medium

Vulnerability Details

Location: contracts/Clearinghouse.sol, Line 519

int128 burnFee = MathHelper.max(ONE, quoteAmount / 1000);  // Min 1e18

Impact

Position	Expected Fee	Actual Fee	Loss
$1,000+	0.1%	0.1%	✅ Normal
$100	$0.10	$1.00	10x
$10	$0.01	$1.00	100x
$1	$0.001	$1.00	100% LOSS

Proof of Concept

const ONE = BigInt("1000000000000000000");

function calculateBurnFee(quoteAmount) {
    const percentageFee = quoteAmount / 1000n;
    return percentageFee > ONE ? percentageFee : ONE;
}

// $1 position
const fee = calculateBurnFee(ONE);
console.log(fee === ONE);  // true - fee equals entire position!

Recommendation

// Option 1: Remove minimum
int128 burnFee = quoteAmount / 1000;

// Option 2: Lower minimum
int128 burnFee = MathHelper.max(1e15, quoteAmount / 1000);  // $0.001 min

README.md
REPORT.md

NlpBurnFeePoC.txt
NlpBurnFeeValidator.js
NlpBurnFeeValidator.txt