# Destroy can avoid the bulk of fees

NestedFactory.destroy only charges fees on order output, so tiny swap orders let users withdraw nearly all assets fee-free.

- Payout: Audit contest
- Severity: medium
- Program: Nested Finance
- Found by: 0xliumin
- Disclosed: 2022-04-27
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2022-02-nested#m-01
- Library page: http://bugbountylibrary.com/r/c4%3A2022-02-nested%3AM-01
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity vuln:business-logic vuln:fee-bypass

**Target:** NestedFactory.destroy / operator order submission
**Root cause:** Fees are computed only on the amount output by callOperator orders; leftover portfolio assets are returned via safeTransfer without fee deduction.
**Steps:**
1. Alice holds an NFT portfolio with 100 gwei dai and 100 gwei uni.
2. Call destroy with buy token = dai, submitting orders: `{operator: ZeroEx, token: uni, calldata: performSwap with a very small amount of uni for dai}` and `{operator: Flat, token: dai, calldata: transfer a very small amount dai for dai}`.
3. Orders satisfy all require statements (MixinOperatorResolver.sol#L100-L101) and succeed.
4. Fees are collected only on the small order output (NestedFactory.sol#L446); remaining 100 gwei uni and 100 gwei dai are safeTransferred directly to the attacker.
**How found:** Reading destroy's fee logic and noticing fees are taken on callOperator output rather than the full withdrawn balance, then crafting orders that pass all require checks while minimizing output.
**Exploitation:** Attacker submits minimal-size swap/transfer orders during destroy so fee calculation applies only to the tiny output, then receives the bulk of the portfolio via direct transfer.
**Insight:** When a fee is computed on order output rather than on the withdrawn balance, look for a path where assets bypass the order pipeline and are transferred directly; minimal-size orders can satisfy constraints while dodging the fee base.