# Management Fee for a vault is charged even when there is no assets under management and subject to manipulation.

Popcorn Vault charges management fee from stale feesUpdatedAt, so a depositor is charged for years with no assets, and vault owner can front-run withdrawals for extra fees.

- Payout: Contest reward
- Severity: medium
- Program: Popcorn
- Credited: ast3ros
- Disclosed: 2023-09-07
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-01-popcorn-findings/issues/499
- Library page: https://bugbountylibrary.com/r/c4%3A2023-01-popcorn%3AM-15
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:reward-distribution

**Target:** ERC4626-style Vault contract (Vault.sol)
**Root cause:** accruedManagementFee multiplies totalAssets by (block.timestamp - feesUpdatedAt), but feesUpdatedAt is only reset on takeManagementAndPerformanceFees/changeAdapter, not on deposit/withdraw, so elapsed time accrues against assets that were not managed.
**Steps:**
1. Deploy and initialize vault at time T; feesUpdatedAt = T with zero assets.
2. Warp 10 years; Alice deposits 100 ether via `vault.deposit(depositAmount, alice)`.
3. Warp 1 second; call `vault.takeManagementAndPerformanceFees()`.
4. Observe feeRecipient receives ~50 ETH of the 100 ETH deposit as management fee accrued over 10 years.
5. For manipulation: Alice deposits 1000 ETH, 7 days pass; owner front-runs Alice's `vault.redeem` with `takeManagementAndPerformanceFees()` to accrue fee on high totalAssets (192.21 ETH vs 190 ETH without front-run).
**How found:** Code reading of accruedManagementFee and noticing feesUpdatedAt is only updated in takeManagementAndPerformanceFees and changeAdapter, not on deposit/withdraw; constructed time-warp PoCs to quantify overcharge and front-run delta.
**Exploitation:** Vault owner deploys vault, waits, lures a deposit, then calls takeManagementAndPerformanceFees to mint fee shares against the full elapsed period; or front-runs a large withdrawal to accrue fees while totalAssets is still high, then redeems fee shares for assets.
**Insight:** When a fee/interest accumulator uses a last-updated timestamp, check every path that changes the denominator (totalAssets) and verify the timestamp is checkpointed there too; stale checkpoints let elapsed time apply to assets that arrived later.