# Rerange/rebalance should not use protocolFee as an asset for adding liquidity

Talos rerange/rebalance adds liquidity using full token balance including accrued protocolFees, so collectProtocolFees later reverts and protocol loses fee revenue.

- Payout: Contest reward
- Severity: high
- Program: Maia DAO Ecosystem
- Credited: T1MOH
- Disclosed: 2023-09-18
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-05-maia-findings/issues/80
- Library page: https://bugbountylibrary.com/r/c4%3A2023-05-maia%3AH-35
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** TalosStrategySimple / PoolActions rerange liquidity minting
**Root cause:** getThisPositionTicks reads token0/token1.balanceOf(address(this)) which includes accrued protocolFees0/1, and rerange mints liquidity with that full balance without decrementing the protocolFee accounting variables.
**Steps:**
1. User deposits 1000 tokens into strategy; fees accrue, 50 counted as protocolFee.
2. Call doRerange/doRebalance: liquidity removed, contract balance = 1100.
3. getThisPositionTicks returns balance0=1100 (includes protocolFee).
4. nonfungiblePositionManager.mint uses amount0Desired=1100, consuming protocolFee tokens.
5. protocolFees0 still records 50 but contract balance is now less; collectProtocolFees(50) reverts on `require(balance0 >= amount0)`.
**How found:** Code reading of rerange flow: noticed getThisPositionTicks uses raw balanceOf rather than balance minus protocolFees, then traced that mint consumes the whole balance while protocolFees0/1 are never decremented.
**Exploitation:** Not an external attack; protocol owner calling collectProtocolFees after a rerange finds insufficient balance and reverts, permanently stranding protocol fee accounting and losing protocol revenue.
**Insight:** When a contract tracks internal fee accounting separately from token balance, any function using balanceOf(address(this)) as an input silently consumes those reserved fees; check every balanceOf-derived amount against outstanding accounting variables.