# Excessive trading fees can result in 99.9% collateral loss for the trader

getSlippageFee scales linearly with trade size regions, so large trades incur order fees exceeding 100% of collateral, draining the trader.

- Payout: Contest reward
- Severity: high
- Program: Polynomial Protocol
- Credited: bytes032
- Disclosed: 2023-08-01
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-03-polynomial-findings/issues/129
- Library page: https://bugbountylibrary.com/r/c4%3A2023-03-polynomial%3AH-09
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:fee-bypass

**Target:** LiquidityPool.getSlippageFee / Exchange orderFee
**Root cause:** getSlippageFee computes region = ceil(sizeDelta/standardSize) and multiplies by baseTradingFee with no cap, so orderFee can exceed the trader's collateral for large positions.
**Steps:**
1. Deposit liquidity into pool via `pool.deposit`.
2. Open a short with `exchange.openTrade` where sizeDelta/standardSize yields a large region (e.g. multiplier 16500).
3. Observe orderFee = hedgingFee + region*baseTradingFee*valueExchanged exceeds collateral.
4. Close the position with `closeShort`; combined open+close fees consume ~99.6% of collateral.
**How found:** Manual review of orderFee flow; noticed getSlippageFee scales region linearly with sizeDelta and lacks any cap, then built Foundry PoC varying the multiplier to show fee percentage growing to 99.6%.
**Exploitation:** Trader opens and closes a large position; the linear region multiplier makes total orderFee approach or exceed 100% of collateral, which is deducted as fees, leaving the trader with near-zero collateral.
**Insight:** When a fee is computed as ceil(size/standardSize)*baseFee, check whether the multiplier is unbounded relative to collateral; test large sizeDelta values to see if total open+close fees can exceed 100% of margin.