# Fee tier and scalar misconfiguration

Hardcoded or default fee, tier, or scalar used where a configured custom value belongs

_Area: DeFi accounting and math bugs. Seen in 4 disclosed reports; latest 2026-02-26. Updated 2026-10-25._

## How it works
A fee, tier, or scalar is a parameter that must agree across every place it is used: the quote and the swap, the config and the real cost, the consensus and the execution layer, the default and the per-holding override. The bug appears when one site uses a hardcoded or default value while another uses the configured one. The two computations then disagree, and the difference is silently absorbed by a balance, a refund, or an undercharge.

## Where it shows up
- A quote call with a literal fee/tier next to an execution call using a variable [E1](https://bugbountylibrary.com/r/c4%3A2024-05-bakerfi%3AH-03.md)
- Config constants that look copied or scaled oddly (e.g. 230e9 vs 230_000e9) [E2](https://bugbountylibrary.com/r/sherlock%3A2024-08-morphl2%3AH-3.md)
- Fee formulas applied uniformly across tx types that should branch (legacy vs EIP-1559) [E3](https://bugbountylibrary.com/r/c4%3A2025-09-monad%3AH-01.md)
- A new fee/override layer added, but some entry points still read the old default field [E4](https://bugbountylibrary.com/r/cantina%3Ajigsaw_june2025%3A3.2.2.md)
- "Refund" or leftover-handling paths that move value to the contract itself [E1](https://bugbountylibrary.com/r/c4%3A2024-05-bakerfi%3AH-03.md)

## How to review
For each fee/tier/scalar, list every site that reads it and confirm they resolve to the same value at runtime. The invariant: quote and execution, config and true cost, and default and override must be identical for the same operation. Recompute scalars against real measured cost rather than trusting the constant [E2](https://bugbountylibrary.com/r/sherlock%3A2024-08-morphl2%3AH-3.md). Diff consensus and execution gas formulas per tx type [E3](https://bugbountylibrary.com/r/c4%3A2025-09-monad%3AH-01.md). Grep every fee-charging entry point for direct reads of the old default after an override layer is introduced [E4](https://bugbountylibrary.com/r/cantina%3Ajigsaw_june2025%3A3.2.2.md). Trace where any leftover or excess goes; it must return to the user or source, not the contract [E1](https://bugbountylibrary.com/r/c4%3A2024-05-bakerfi%3AH-03.md).

## Variants seen
- Quote uses hardcoded tier, swap uses configured tier; leftover self-transferred and locked [E1](https://bugbountylibrary.com/r/c4%3A2024-05-bakerfi%3AH-03.md)
- Scalar off by 100X, underpricing L1 fees [E2](https://bugbountylibrary.com/r/sherlock%3A2024-08-morphl2%3AH-3.md)
- EIP-1559 ceiling wrongly applied to legacy txs [E3](https://bugbountylibrary.com/r/c4%3A2025-09-monad%3AH-01.md)
- Claim path reads default fee instead of custom holding fee [E4](https://bugbountylibrary.com/r/cantina%3Ajigsaw_june2025%3A3.2.2.md)

## Impact and severity
Consequences ranged from permanently locked user collateral [E1](https://bugbountylibrary.com/r/c4%3A2024-05-bakerfi%3AH-03.md) and sequencer revenue loss [E2](https://bugbountylibrary.com/r/sherlock%3A2024-08-morphl2%3AH-3.md) to consensus/execution divergence that can invalidate blocks [E3](https://bugbountylibrary.com/r/c4%3A2025-09-monad%3AH-01.md) and systematic over/undercharging on every claim [E4](https://bugbountylibrary.com/r/cantina%3Ajigsaw_june2025%3A3.2.2.md). Severity rises when the mismatch is silent, repeats on every operation, or touches consensus-critical accounting.

## Why fixes fail
Fixing one site (e.g. the swap) without the matching quote site leaves the mismatch; the parameter must be threaded through both [E1](https://bugbountylibrary.com/r/c4%3A2024-05-bakerfi%3AH-03.md). Adding an override layer without updating all entry points leaves old defaults live [E4](https://bugbountylibrary.com/r/cantina%3Ajigsaw_june2025%3A3.2.2.md).

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2024-05-bakerfi%3AH-03.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2024-08-morphl2%3AH-3.md
- E3: https://bugbountylibrary.com/r/c4%3A2025-09-monad%3AH-01.md
- E4: https://bugbountylibrary.com/r/cantina%3Ajigsaw_june2025%3A3.2.2.md