# Owner can modify the feeRate on existing vaults and steal the strike value on exercise

Cally owner can raise feeRate on existing vaults to consume the entire exercise payment, stealing the strike value owed to the option seller.

- Payout: Contest reward
- Severity: medium
- Program: Cally
- Credited: IllIllI
- Disclosed: 2022-07-01
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-05-cally-findings/issues/47
- Library page: https://bugbountylibrary.com/r/c4%3A2022-05-cally%3AM-01
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** Solidity options vault contract (Cally.sol) exercise/fee logic
**Root cause:** setFee has no restriction on changing feeRate for already-created vaults, and exercise computes fee = msg.value * feeRate / 1e18 with no cap, so a rate near 1e18 diverts the whole exercise payment to protocolUnclaimedFees.
**Steps:**
1. Owner calls `setFee(feeRate_)` with a rate close to 1e18 (e.g. 1e18) via the unrestricted `onlyOwner` setter.
2. A seller creates a vault and a buyer exercises it, sending `msg.value` equal to the strike.
3. In exercise, `fee = (msg.value * feeRate) / 1e18` consumes nearly all of msg.value; `ethBalance[beneficiary] += msg.value - fee` leaves the seller almost nothing.
4. Owner withdraws accumulated `protocolUnclaimedFees`.
**How found:** Code review of the fee setter and exercise fee math: noticed setFee lacks any per-vault locking or cap, then traced how feeRate multiplies msg.value in exercise to see the seller's payout can be zeroed.
**Exploitation:** Malicious or compromised owner waits for a high-value NFT option, sets feeRate to consume the exercise cost, lets the option be exercised, then collects the diverted strike via protocolUnclaimedFees and retires.
**Insight:** When a protocol fee is a mutable global parameter applied at exercise/settlement time, check whether it can be changed after user positions are opened; a rate with no upper bound lets the owner capture the entire payout.