# Masterchef: Improper handling of deposit fee

MasterChef deducts a deposit fee from user credit but never credits it to anyone, permanently locking fee tokens in depositor contracts.

- Payout: Audit contest
- Severity: high
- Program: Concur Finance
- Found by: hickuphh3
- Disclosed: 2022-05-24
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-02-concur-findings/issues/138
- Library page: https://bugbountylibrary.com/r/c4%3A2022-02-concur%3AH-02
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:fee-bypass

**Target:** MasterChef.sol deposit accounting
**Root cause:** Deposit fee is subtracted from user.amount but never added to any fee recipient's balance, so the fee tokens remain in the depositor contract with no accounting entry.
**Steps:**
1. Configure a pool with `depositFeeBP = 100` (10%).
2. Alice deposits 1000 LP via ConvexStakingWrapper; wrapper credits 1000 in its `deposits` mapping.
3. MasterChef credits only 900 to `user.amount` (1000 - 100 fee).
4. Alice calls `requestWithdraw(1000)` then `withdraw(1000)`; withdraw reverts since MasterChef only has 900 credited.
5. The 100 LP fee is stranded, credited to no party.
**How found:** Code reading of the deposit fee branch in MasterChef.sol#L170-L172, noticing the fee is subtracted but never assigned to a recipient, then tracing withdrawal accounting in ConvexStakingWrapper and StakingRewards.
**Exploitation:** Not an attacker-driven exploit; the flaw causes permanent lockup of deposit fees (protocol-owned liquidity) and blocks full withdrawal by depositors.
**Insight:** When a fee is deducted from a user's credited balance, verify the deducted amount is actually credited somewhere; otherwise it becomes unaccounted stranded funds that also break full-withdraw paths.