# Wrong fee calculation after totalSupply was 0

Kuiper Basket's handleFees returns early when totalSupply is 0 without updating lastFee, so fees are over-minted for the entire inactive period, diluting existing holders.

- Payout: Audit contest
- Severity: high
- Program: Kuiper
- Found by: kenzo
- Disclosed: 2022-05-02
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2021-12-defiprotocol-findings/issues/58
- Library page: https://bugbountylibrary.com/r/c4%3A2021-12-defiprotocol%3AH-01
- Tags: area:web3 domain:web3 impact:funds-loss impact:integrity kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** Basket.sol handleFees fee accounting in DeFi basket protocol
**Root cause:** handleFees returns early when startSupply == 0 without setting lastFee = block.timestamp, so the next call computes timeDiff from the old lastFee covering the whole inactive period.
**Steps:**
1. All holders burn tokens; last burn sets totalSupply to 0.
2. Wait ~1 day with supply at 0.
3. User mints; handleFees hits `else if (startSupply == 0) { return; }` at Basket.sol#L136-L137 and does not update lastFee.
4. Next block another user mints; handleFees computes `timeDiff = block.timestamp - lastFee` (Basket.sol#L139) using the stale lastFee from before the zero-supply period.
5. Extra fee tokens are minted as if a full day elapsed, diluting existing holders.
**How found:** Code reading of handleFees: noticed the startSupply == 0 branch returns without updating lastFee, then traced the timeDiff calculation to see the stale timestamp would be used on the next mint.
**Exploitation:** A malicious publisher can set up a basket as a honeypot: let supply drop to 0, wait, then trigger mints so handleFees over-mints fee tokens at the expense of regular basket token owners, who receive less underlying on withdrawal.
**Insight:** In fee/interest accrual contracts, every early-return path must still checkpoint the timestamp accumulator; audit branches where supply or balance is zero for missing lastFee/lastUpdate writes.