# OpenLevV1.closeTrade with V3 DEX doesn't correctly accounts fee on transfer tokens for repayments

UniV3Dex.uniV3Sell trusts DEX-returned swap amount instead of balance delta, so fee-on-transfer tokens cause repayment over-accounting, draining funds or freezing positions.

- Payout: Audit contest
- Severity: medium
- Program: OpenLeverage
- Found by: hyh
- Disclosed: 2022-03-09
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-01-openleverage-findings/issues/104
- Library page: https://bugbountylibrary.com/r/c4%3A2022-01-openleverage%3AM-04
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** OpenLevV1.closeTrade / UniV3Dex.uniV3Sell
**Root cause:** uniV3Sell uses the DEX-reported swap output as the received amount rather than measuring the actual balance delta, so fee-on-transfer tokens deliver less than accounted.
**Steps:**
1. Use a fee-on-transfer token as depositToken/longToken in a trade.
2. Open a position, then call closeTrade with flashSell via UniV3Dex.
3. uniV3Sell returns DEX-indicated receiveAmount, but actual received balance is lower due to transfer fee.
4. Repayment accounting uses inflated receiveAmount, creating a system deficit.
5. Repeat open/close to drain contract funds; or doTransferOut reverts when insufficient balance, freezing the position.
**How found:** Code review of UniV3Dex.uniV3Sell noting it uses DEX-returned amount instead of before/after balance check, unlike fee-on-transfer-safe patterns; traced into closeTrade repayment accounting.
**Exploitation:** Malicious user repeatedly opens and closes positions with a taxed token; each close over-credits repayment relative to actual received funds, extracting the difference from the contract until funds are drained. If insufficient funds exist, doTransferOut reverts and the user's position cannot be closed.
**Escalation:** Repeated open/close cycles scale the deficit into full contract fund drain.
**Insight:** When auditing DEX adapters, check whether received amounts come from the router's return value or an actual balance delta; any adapter trusting the return value breaks on fee-on-transfer/rebasing tokens and corrupts downstream debt accounting.