# Swivel: Taker is charged fees twice in exitVaultFillingVaultInitiate

In Swivel's exitVaultFillingVaultInitiate, the taker pays the protocol fee twice while the maker pays none, leaving the taker unable to recoup the extra fee.

- Payout: Audit contest
- Severity: high
- Program: Swivel
- Found by: itsmeSTYJ
- Disclosed: 2021-11-05
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-09-swivel-findings/issues/39
- Library page: https://bugbountylibrary.com/r/c4%3A2021-09-swivel%3AH-02
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity vuln:accounting-error vuln:business-logic vuln:fee-bypass

**Target:** Swivel vault exit order-matching contract function
**Root cause:** The fee is deducted from the taker's premium transfer instead of being charged to the maker, so the taker nets premiumFilled - 2*fee while the maker pays nothing.
**Steps:**
1. Call `exitVaultFillingVaultInitiate(o, a, c)` with a valid order and signature.
2. Observe maker transfers `premiumFilled` to taker, then taker transfers `fee` to Swivel.
3. Net taker balance = `premiumFilled - 2*fee`; maker retains the fee it should have paid.
**How found:** Code review of the fee accounting in exitVaultFillingVaultInitiate, comparing who transfers the premium versus who is charged the fee.
**Insight:** In order-matching exit functions, trace each fee deduction against the party that should bear it; a fee taken from the counterparty's received premium silently double-charges them.