# Incorrect burn address in Vader.sol

Vader.sol _transfer burns fees from msg.sender instead of the actual sender, so transferFrom/transferTo burn fees from the wrong account, breaking accounting.

- Payout: Audit contest
- Severity: high
- Program: Vader Protocol
- Disclosed: 2021-06-14
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-04-vader-findings/issues/202
- Library page: https://bugbountylibrary.com/r/c4%3A2021-04-vader%3AH-06
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error

**Target:** Vader.sol ERC-20 token contract _transfer/_burn
**Root cause:** _transfer() uses msg.sender as the burn address on L129 instead of the sender parameter, which differs for transferFrom() (sender param) and transferTo() (tx.origin).
**Steps:**
1. Call transferFrom() or transferTo() so the sender parameter differs from msg.sender (e.g. an intermediate contract).
2. _transfer() computes _fee and calls `_burn(msg.sender, _fee)` on L129, burning from the wrong account.
3. Observe fees burned from the intermediate/msg.sender account rather than the actual sender, corrupting balances.
4. Fix: change L129 to `_burn(sender, _fee);`
**How found:** Code review of _transfer() callers: noted transfer(), transferFrom(), transferTo() pass different senders, then checked that _burn used msg.sender rather than the sender parameter.
**Insight:** When a shared internal transfer helper is called by wrappers with differing sender semantics (msg.sender vs param vs tx.origin), audit every use of msg.sender inside the helper for context mismatch.