Gorgeous Malachite Bee - Incorrect fee validation allows excessive individual fees if their sum is within limit.

[sherlock-admin4]

Gorgeous Malachite Bee

Medium

Incorrect fee validation allows excessive individual fees if their sum is within limit.

The setFees function incorrectly checks if the sum of all fees exceeds 1e6, allowing individual fees (e.g., deposit fee) to be set to 100% (1e6) as long as others are zero.

This can lead to one fee consuming the entire transaction amount, which is unintended and exploitable by a malicious or compromised owner.

https://github.com/sherlock-audit/2025-07-mellow-flexible-vaults/blob/main/flexible-vaults/src/managers/FeeManager.sol#L160-L161

        if (depositFeeD6_ + redeemFeeD6_ + performanceFeeD6_ + protocolFeeD6_ > 1e6) {
            revert InvalidFees(depositFeeD6_, redeemFeeD6_, performanceFeeD6_, protocolFeeD6_);

Recommendation

Validate each fee individually (e.g., each fee ≤ 1e6) instead of summing them. This ensures no single fee exceeds 100% and aligns with typical fee structure expectations.