# Treasury fee is not collected in withdrawEthWithInterest()

withdrawEthWithInterest pays full interest to lender without deducting treasury fee, so protocol loses its cut on every ETH loan withdrawal.

- Payout: Contest reward
- Severity: high
- Program: Particle Protocol
- Credited: adriro
- Disclosed: 2023-08-07
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-05-particle-findings/issues/20
- Library page: https://bugbountylibrary.com/r/c4%3A2023-05-particle%3AH-02
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:fee-bypass

**Target:** ParticleExchange.sol withdrawEthWithInterest()
**Root cause:** withdrawEthWithInterest transfers lien.price + payableInterest directly to the lender instead of accruing interest via interestAccrued, bypassing the treasury split in _withdrawAccountInterest().
**Steps:**
1. Lender calls `withdrawEthWithInterest(lien, lienId)` on a lien with accrued interest.
2. Line 201 computes `payableInterest = _calculateCurrentPayableInterest(lien)`.
3. Line 212 transfers `lien.price + payableInterest` in full to lender.
4. No treasury proportion is deducted; `_treasury` never credited for this interest.
**How found:** Code review comparing the interest-withdrawal path (_withdrawAccountInterest, which splits treasury fee) against withdrawEthWithInterest, noticing the latter pays interest directly without routing through the accrual mapping.
**Exploitation:** Any lender withdrawing ETH with interest receives the full interest amount; the treasury's proportional fee is never accumulated, so the protocol silently loses revenue on each such withdrawal.
**Insight:** When a protocol has a central fee-splitting helper, grep every payout path that computes interest/revenue directly and check whether it bypasses that helper; parallel withdraw functions (ETH vs NFT) are a common place for one branch to skip the fee logic.