# Attacker can keep fees max at no cost

Trader Joe's FeeHelper updates last-swap timestamp even when volatility reference is frozen, letting an attacker spam dust swaps to keep fees maxed cheaply.

- Payout: Contest reward
- Severity: medium
- Program: Trader Joe
- Credited: Trust
- Disclosed: 2022-12-22
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2022-10-traderjoe-findings/issues/430
- Library page: https://bugbountylibrary.com/r/c4%3A2022-10-traderjoe%3AM-05
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:fee-bypass

**Target:** LB pair variable fee / FeeHelper.updateVariableFeeParameters
**Root cause:** When time since last swap is below filterPeriod, volatilityReference is not decayed but _fp.time is still updated, so Vr never decays and Va stays at least Vr.
**Steps:**
1. Cross many bins with a large swap to raise volatilityAccumulated.
2. Wait ~99s (>= filterPeriod, < decayPeriod) and swap so Va decays into Vr.
3. Loop: every 49s (< filterPeriod) perform a dust swap; _fp.time updates but Vr is untouched.
4. Observe volatilityReference and volatilityAccumulated remain high across iterations.
**How found:** Code reading of updateVariableFeeParameters: noticed _fp.time is set unconditionally while Vr update is gated on _deltaT >= filterPeriod, implying Vr can be frozen by sub-filterPeriod swaps.
**Exploitation:** Attacker (a competing AMM) performs a dust swap just under every filterPeriod (default 1728/day) at ~$0.05 tx cost, keeping the pair's variable fee permanently high and uncompetitive at ~$87/day.
**Insight:** In time-decay fee/rate designs, check whether the 'last update' timestamp advances on paths that skip the decay computation — that lets an attacker reset the decay clock with dust transactions and pin the accumulator high.