# Collect modules can fail on zero amount transfers if treasury fee is set to zero

Collect modules unconditionally transfer the treasury fee, so a zero treasury fee plus a token that reverts on zero-value transfers bricks all collect operations.

- Payout: Audit contest
- Severity: medium
- Program: Aave Lens
- Found by: hyh
- Disclosed: 2022-06-13
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2022-02-aave-lens#m-09
- Library page: http://bugbountylibrary.com/r/c4%3A2022-02-aave-lens%3AM-09
- Tags: area:web3 domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** Collect/follow modules (FeeCollectModule, LimitedFeeCollectModule, TimedFeeCollectModule, LimitedTimedFeeCollectModule, FeeFollowModule) and ModuleGlobals treasury fee
**Root cause:** Treasury fee can be set to zero in ModuleGlobals, but collect modules call safeTransferFrom for treasuryAmount unconditionally without checking it is positive.
**Steps:**
1. Set treasury fee to zero via ModuleGlobals (ModuleGlobals.sol#L109).
2. Set a collect fee currency to an ERC20 that reverts on zero-value transfers.
3. Call collect on a publication using FeeCollectModule/LimitedFeeCollectModule/TimedFeeCollectModule/LimitedTimedFeeCollectModule (e.g. FeeCollectModule.sol#L176) or follow via FeeFollowModule.sol#L90.
4. The unconditional `IERC20(currency).safeTransferFrom(follower, treasury, treasuryAmount)` with treasuryAmount=0 reverts, blocking the operation.
**How found:** Code review: noticed treasury fee is settable to zero, then observed all collect modules transfer treasuryAmount without a positivity check, and cross-referenced weird-ERC20 tokens that revert on zero-value transfers.
**Exploitation:** Any user attempting a collect or fee-follow on an affected currency reverts, rendering collect functionality unavailable for that token; no attacker gain beyond DoS.
**Insight:** When a config value is settable to zero, audit every downstream transfer/arithmetic that consumes it against weird-ERC20 behaviors (revert-on-zero, revert-on-large-approval) — a benign default can brick a whole module.