# Basket.sol#handleFees() could potentially cause disruption of minting and burning

Basket.handleFees underflows when timeDiff*licenseFee exceeds ONE_YEAR, making feePct>BASE and reverting all mint/burn calls.

- Payout: Audit contest
- Severity: medium
- Program: Kuiper
- Found by: WatchPug
- Disclosed: 2022-01-26
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-09-defiprotocol-findings/issues/79
- Library page: https://bugbountylibrary.com/r/c4%3A2021-09-defiprotocol%3AM-14
- Tags: area:web3 domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:dos

**Target:** Solidity Basket contract handleFees()
**Root cause:** feePct = timeDiff*licenseFee/ONE_YEAR is unbounded; with large licenseFee or long inactivity it exceeds BASE, so BASE - feePct underflows and reverts.
**Steps:**
1. Deploy basket with licenseFee = 1e19 (1000%/yr) and mint 1 basket token
2. Leave basket inactive ~2 months
3. Call mint or burn; both revert inside handleFees() at BASE - feePct
**How found:** Code review of handleFees arithmetic: noticed feePct derived from unbounded timeDiff*licenseFee could exceed BASE, causing subtraction underflow.
**Insight:** In fee-accrual math, check that time*rate products stay below the denominator constant; long inactivity windows are an easy trigger for underflow DoS.