# Wrong implementation of performanceFee can cause users to lose 50% to 100% of their funds

Mellow LpIssuer mints performanceFee from full baseSupply times price factor instead of profit, minting >100% of supply and diluting users 50-100%.

- Payout: Audit contest
- Severity: high
- Program: Mellow Protocol
- Found by: WatchPug
- Disclosed: 2022-02-09
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2021-12-mellow-findings/issues/91
- Library page: https://bugbountylibrary.com/r/c4%3A2021-12-mellow%3AH-02
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:reward-distribution

**Target:** LpIssuer.sol vault share minting / _chargeFees
**Root cause:** toMint uses baseSupply * minLpPriceFactor / DENOMINATOR, ignoring performanceFee and subtracting no principal, so it mints roughly the entire existing supply rather than a fee on profit.
**Steps:**
1. Alice deposits 1000 USDC, gets 1000 lpTokens; totalSupply=1000.
2. baseTvl rises to 1001 USDC; Bob deposits 1 USDC triggering _chargeFees().
3. minLpPriceFactor ~1.001; toMint = 1000*1.001 = 1001 lpTokens minted to strategyPerformanceTreasury.
4. Treasury now holds ~50% of supply; Alice diluted ~50%.
**How found:** Code review of the toMint formula in LpIssuer._chargeFees noticed performanceFee was never multiplied in and principal was not subtracted.
**Exploitation:** Any deposit that triggers _chargeFees() mints ~baseSupply*minLpPriceFactor lpTokens to the performance treasury, diluting existing depositors by 50-100% per charge.
**Escalation:** Repeated fee charges compound dilution toward 100% loss.
**Insight:** When auditing fee-minting logic, verify the fee is computed on profit (priceFactor - DENOMINATOR) and scaled by the fee rate, not on total supply times price.