# Users can avoid paying vault fees

LPIssuer skips fee minting when elapsed time is under managementFeeChargeDelay, letting users deposit large TVL, earn yield, and withdraw fee-free.

- Payout: Audit contest
- Severity: medium
- Program: Mellow Protocol
- Found by: cmichel
- Disclosed: 2022-02-09
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-12-mellow-findings/issues/47
- Library page: https://bugbountylibrary.com/r/c4%3A2021-12-mellow%3AM-03
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:business-logic vuln:fee-bypass

**Target:** LPIssuer deposit/withdraw fee logic (Solidity vault)
**Root cause:** _chargeFees returns early when elapsed < managementFeeChargeDelay, so no protocol/management/performance fees are minted for deposits and withdrawals occurring within that window.
**Steps:**
1. Deposit a tiny amount to trigger _chargeFees and set lastFeeCharge.
2. Deposit a large amount, inflating TVL.
3. Let the position accrue interest.
4. Withdraw before managementFeeChargeDelay elapses; no fees are charged.
5. Repeat so fees are only ever paid on the tiny TVL.
**How found:** Code reading of _chargeFees early-return condition combined with the fee-charge delay parameter; recognized the time-window gap between charge events as an exploitable fee-avoidance window.
**Exploitation:** Attacker sandwiches fee-charge windows: keeps TVL tiny at charge time, inflates TVL during the delay window to earn yield, then exits before the next charge, paying negligible fees. Profitable where gas cost < three vault fees.
**Insight:** When fee logic is gated by an elapsed-time threshold, check whether TVL can be inflated inside the gap and deflated before the next charge — the fee base at charge time is what matters, not average holdings.