# NonUSTStrategy.sol Improper handling of swap fees allows attacker to steal funds from other users

NonUSTStrategy charges swap fees to the whole vault instead of the depositor, letting a majority LP deposit, withdraw, and reclaim others' fees.

- Payout: Audit contest
- Severity: medium
- Program: Sandclock
- Found by: WatchPug
- Disclosed: 2022-02-23
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-01-sandclock-findings/issues/158
- Library page: https://bugbountylibrary.com/r/c4%3A2022-01-sandclock%3AM-02
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:chained technique:source-review vuln:accounting-error vuln:business-logic vuln:fee-bypass

**Target:** NonUSTStrategy.sol vault deposit/withdraw swap logic
**Root cause:** Swap fee incurred when converting non-UST assets to UST on deposit is not attributed to the depositor but spread across all vault users via share issuance.
**Steps:**
1. Add ~$1M liquidity to a low-liquidity FRAX-UST Curve pool to hold >50% share
2. Deposit 1M FRAX into the NonUST vault, receiving depositAmount of 1M
3. Strategy swaps 1M FRAX to UST via Curve pool, paying swap fee
4. Withdraw all vault funds
5. Remove the Curve liquidity added in step 1, reclaiming majority of the swap fee
**How found:** Code review of NonUSTStrategy deposit path noting swap fee is not charged to the depositor, unlike ZapIn-style vaults; reasoned that a majority LP could recapture fees paid by others.
**Exploitation:** Attacker becomes majority LP of the Curve pool, deposits into the vault so the strategy pays swap fees, then withdraws and removes liquidity to capture most of the fee back; optionally sandwich the swap (issue #160) for more profit.
**Escalation:** Chaining with sandwich attack (#160) on the strategy's swap to amplify profit.
**Insight:** In vaults that swap on deposit, check whether swap fee/slippage is priced into share issuance; if socialized, a majority LP of the swap pool can round-trip deposits to harvest fees from other depositors.