Hesty Disclosed Report

https://github.com/la-bomba-studio/hesty-contract/tree/29596447b9a06d4ad53360d4a15f349ebf9fa0d8

When a user purchases tokens by calling the buyTokens function in the token factory, they are charged a total amount, which is the sum of boughtTokensPrice and applicable fees. The boughtTokensPrice is then stored in the userInvested variable.

If a property sale fails, the user can invoke the recoverFundsInvested function to reclaim their investment. This function retrieves the value stored in userInvested and refunds the corresponding amount of tokens based on that value. However, since the userInvested variable only holds the boughtTokensPrice and does not include the fees paid by the user, the fees are not refunded.

This leads to all the user who invested in the failed property bid loosing their fees. This is against the protocol design as mentioned in the following line in the readme file "Fees are not immediately charged because in the case the threshold is not reached for the raise all funds must be able to be claimed back by investors including all the fees charged."

#root cause The fees is not added to userInvested variable Line 296

Only the value in userInvested variable is refunded to the user Line 420

Line 424