# Griefer can extend period of higher withdrawal fees

Anyone can transfer 1 wei of LP tokens to a victim, resetting lastActionTimestamp and extending their withdrawal-fee decay cooldown, costing them extra fees.

- Payout: Audit contest
- Severity: medium
- Program: Backd
- Credited: 0xDjango
- Disclosed: 2022-06-02
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-04-backd-findings/issues/56
- Library page: https://bugbountylibrary.com/r/c4%3A2022-04-backd%3AM-10
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** LiquidityPool.sol withdrawal fee accounting
**Root cause:** _updateUserFeesOnDeposit resets meta.lastActionTimestamp to now on any deposit/transfer-in, even a 1-wei transfer, restarting the fee decay window instead of scaling the timestamp proportionally to the added shares.
**Steps:**
1. User A holds 100 wei shares, waits 1 week so fee decays to ~5% (max 10%, 2-week decay).
2. Attacker B holds 1 wei shares at 10% fee.
3. B transfers 1 wei of shares to A via LP token transfer.
4. _updateUserFeesOnDeposit runs for A: feeRatio barely changes (weighted by share proportion) but `meta.lastActionTimestamp = uint64(_getTime())` resets.
5. A's fee now decays from 5% over a full 2 weeks instead of the remaining 1 week, doubling the cooldown runway.
**How found:** Code review of the fee-decay logic: noticed lastActionTimestamp is unconditionally reset on deposit while feeRatio is proportionally weighted, and that LP tokens are freely transferable by anyone, enabling unsolicited transfers.
**Exploitation:** Griefer repeatedly sends 1 wei of LP tokens to a target to keep resetting lastActionTimestamp, forcing the victim to pay elevated withdrawal fees or wait longer to withdraw cheaply.
**Insight:** When a decay/cooldown timer is reset on any balance change, check whether an attacker can trigger that change on the victim's behalf (unsolicited token transfers, dust deposits) to grief the timer; compare how the value (fee) is weighted vs how the timestamp is reset.