# BathBuddy  contract's vestedAmount function includes fees leading to users being disproportionately rewarded after whale withdraws

BathBuddy's vestedAmount double-counts withdrawal fees (in balanceOf and released), letting a small depositor drain disproportionate rewards after a whale withdraws.

- Payout: Contest reward
- Severity: medium
- Program: Rubicon
- Credited: sseefried
- Disclosed: 2022-08-01
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-05-rubicon-findings/issues/191
- Library page: https://bugbountylibrary.com/r/c4%3A2022-05-rubicon%3AM-30
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:reward-distribution

**Target:** BathBuddy.sol reward vesting contract
**Root cause:** totalAllocation is computed as IERC20(token).balanceOf(address(this)) + released(token); fees retained in the contract are counted in balanceOf and again in _erc20Released (incremented by amount, not amountWithdrawn), double-counting fees.
**Steps:**
1. Set fee to 50 BPS.
2. Whale deposits 200 tokens; minnow deposits 0.01 tokens.
3. BathBuddy contract set up for BathToken.
4. Whale withdraws; fees remain in BathBuddy and inflate vestedAmount.
5. Minnow withdraws; sharesWithdrawn == initialTotalSupply so mul(sharesWithdrawn).div(initialTotalSupply) == 1, making amount = releasable, draining disproportionate fees.
**How found:** Code reading of vestedAmount/totalAllocation; noticed fees are never transferred out of BathBuddy so balanceOf includes them, and _erc20Released is updated with amount rather than amountWithdrawn, causing double accounting.
**Exploitation:** A small depositor waits for a whale to withdraw (leaving fees in the contract), then withdraws; the inflated vestedAmount yields rewards far exceeding their share, draining fees meant for HODLers.
**Insight:** When a vesting/reward contract computes total allocation as balanceOf + released, check whether retained fees or unclaimed amounts are counted in both terms; _erc20Released updated by gross amount instead of amount actually withdrawn double-counts.