# VADER contains a Fee-On-Transfer

Vader token's fee-on-transfer means XVader.enter() credits more than received, letting attacker loop enter/leave to drain the contract.

- Payout: Audit contest
- Severity: high
- Program: Vader Protocol
- Found by: jayjonah8
- Disclosed: 2022-02-10
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-11-vader-findings/issues/11
- Library page: https://bugbountylibrary.com/r/c4%3A2021-11-vader%3AH-03
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:fee-bypass

**Target:** XVader.sol staking contract
**Root cause:** XVader credits the nominal deposit amount rather than the actual balance received, ignoring the Vader token's fee-on-transfer behavior, so each enter/leave cycle leaves a fee-sized deficit in the contract.
**Steps:**
1. Attacker calls `enter(500 Vader)`; contract credits 500 but receives 500 minus fee.
2. Attacker calls `leave()` to withdraw credited 500, extracting the fee difference.
3. Repeat enter/leave loop to drain contract balance.
**How found:** Read whitepaper noting Vader is fee-on-transfer, then reviewed XVader.sol deposit/withdraw accounting and noticed balance credited by nominal amount instead of measured delta.
**Exploitation:** Loop enter()/leave() calls so credited amounts exceed actual tokens received, accumulating the fee delta as profit until the contract is drained.
**Insight:** When a token is fee-on-transfer or rebasing, always compare pre/post balanceOf deltas rather than trusting the passed amount; loopable deposit/withdraw pairs amplify the per-call fee leak into full drainage.