# User that delegate eth to RdpxV2Core will incur loss if his delegated eth fulfilled by decaying bonds

bondWithDelegate with decaying bonds charges delegatee undiscounted WETH plus premium while minting fewer bond tokens, causing delegatee loss.

- Payout: Contest reward
- Severity: medium
- Program: Dopex
- Credited: said
- Disclosed: 2023-12-29
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-08-dopex-findings/issues/780
- Library page: https://bugbountylibrary.com/r/c4%3A2023-08-dopex%3AM-11
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic

**Target:** RdpxV2Core.bondWithDelegate / calculateBondCost (Solidity contract)
**Root cause:** calculateBondCost applies no bond discount when rdpxBondId != 0, so decaying-bond path charges full ETH_RATIO_PERCENTAGE WETH and full premium, while _calculateAmounts splits tokens by delegate fee, leaving delegatee with less bond for more WETH.
**Steps:**
1. Mint decaying bond to alice via rdpxDecayingBonds.mint(alice, block.timestamp+10, 125e16)
2. Add delegate: rdpxV2Core.addToDelegate(50e18, 10e8)
3. Call calculateBondCost(1e18, 0) vs calculateBondCost(1e18, 1) to compare wethRequired
4. Call bondWithDelegate(alice, [1e18], [0], 0) and bondWithDelegate(alice, [1e18], [0], 1)
5. Observe wethRequired 0.80625e18 vs 0.8125e18 and delegateAmounts 197562425683709869 vs 197058823529411765
**How found:** Code reading of bondWithDelegate/_bondWithDelegate/calculateBondCost noting the else branch (rdpxBondId != 0) skips bondDiscount entirely, then wrote a Foundry PoC comparing decaying vs non-decaying bond costs.
**Exploitation:** Delegatee can front-run by withdrawing delegated assets before a bondWithDelegate call using decaying bonds, avoiding the unfavorable fill; otherwise delegatee absorbs the loss.
**Insight:** When a discount is applied in one branch of a pricing function, check every caller path that can reach the non-discounted branch with the same collateral; here the decaying-bond branch bypasses bondDiscount but still charges premium.