# Logic error in fee subtraction

LibBalances.applyTrade adds the fee to the long position instead of subtracting it, letting fees be double-counted and causing incorrect quote token withdrawals.

- Payout: Audit contest
- Severity: high
- Program: Tracer
- Found by: 0xsanson
- Disclosed: 2021-09-16
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-06-tracer-findings/issues/127
- Library page: https://bugbountylibrary.com/r/c4%3A2021-06-tracer%3AH-04
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:fee-bypass

**Target:** LibBalances.applyTrade / TracerPerpetualSwaps
**Root cause:** In applyTrade the fee is subtracted from the short position but added to the long position, whereas the fee should be subtracted from both, so the contract believes it holds more quote tokens than it does.
**Steps:**
1. Inspect `LibBalances.applyTrade()` around the highlighted line (L187) where the long balance is updated with `+fee`.
2. Compare with the intended fee handling in `TracerPerpetualSwaps.sol` L272, which subtracts the fee from both sides.
3. Observe the long position is credited the fee rather than debited, inflating tracked balances.
4. Withdrawals then allow more quote tokens out than the contract actually holds, leaving users with incorrect amounts.
**How found:** Code review of the fee accounting in applyTrade, comparing the sign of the fee update against the reference implementation in TracerPerpetualSwaps.
**Exploitation:** Repeated trades accrue phantom fee credit to the long side; the inflated balance is then withdrawable, draining quote tokens the contract does not actually hold.
**Insight:** When a library helper and the main contract both implement the same accounting, diff the sign and direction of every balance mutation between them; a single flipped sign in a fee term silently inflates solvency.