# Flashloan fee collection mechanism can be easily manipulated

Trader Joe LBPair flashLoan pays fees only to active-bin LPs, so borrowers or MEV frontrunners add liquidity to the active bin to capture most flashloan fees.

- Payout: Contest reward
- Severity: medium
- Program: Trader Joe
- Credited: shung
- Disclosed: 2022-12-22
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-10-traderjoe-findings/issues/136
- Library page: https://bugbountylibrary.com/r/c4%3A2022-10-traderjoe%3AM-03
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:fee-bypass vuln:flash-loan

**Target:** LBPair.flashLoan / LBRouter liquidity functions (Solidity, LB v2)
**Root cause:** flashLoan lends the entire pair balance but distributes fees only to the active bin's LPs via accTokenXPerShare/accTokenYPerShare, so a tiny active-bin position captures fees proportional to the whole loan.
**Steps:**
1. Observe LBPair.flashLoan transfers full tokenX/tokenY balances to borrower (`tokenX.safeTransfer(_to, _amountXOut)`).
2. Note fees credited only to `_bins[_id]` (active bin) via `accTokenXPerShare += _feesX.getTokenPerShare(_totalSupply)`.
3. Atomically: `LBRouter.addLiquidity({binId: ACTIVE_BIN, tokenXAmount: 9, tokenYAmount: 9})`.
4. `LBPair.flashLoan({tokenXAmount: 359, tokenYAmount: 0})` borrowing nearly all pair liquidity.
5. `LBRouter.removeLiquidity({binId: ACTIVE_BIN, tokenXAmount: 9, tokenYAmount: 9})` to withdraw the inflated fee share.
**How found:** Code reading of flashLoan: noticed full-balance loan vs. fee accrual restricted to active bin, then constructed a bin-distribution scenario where active bin is a tiny fraction of liquidity.
**Exploitation:** Borrower or MEV searcher frontruns/atomically wraps a flashloan with addLiquidity into the active bin then removeLiquidity after, capturing ~90% of fees while supplying ~2.5% of tokenX liquidity; drains LP fee revenue.
**Escalation:** Third-party MEV sandwiching of any flashloan transaction scales the fee theft across all flashloan users.
**Insight:** When a lending/loan primitive pays fees per-share only to a narrow state slice (active bin/tick) but lends across all liquidity, check whether entering that slice just-in-time captures disproportionate fees.