# When price is within position's range, deposit at TokenisableRange can cause loss of funds

TokenisableRange.deposit computes fee clawback from live slot0 price; if price exits the tick range before execution, the entire token1 deposit is charged as fee.

- Payout: Contest reward
- Severity: high
- Program: Good Entry
- Credited: xuwinnie
- Disclosed: 2023-10-02
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-08-goodentry-findings/issues/373
- Library page: https://bugbountylibrary.com/r/c4%3A2023-08-goodentry%3AH-01
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** TokenisableRange.deposit / Uniswap V3 liquidity position
**Root cause:** Fee clawback uses getAmountsForLiquidity at current slot0 price; when price moves outside the position range, one token's amount is 0, so newFee = n (full deposit) is treated as owed fee.
**Steps:**
1. Position range [120,122], slot0 price 121; user calls `deposit({n0:100, n1:100})`.
2. Price moves to 119 before tx executes (slippage/frontrun).
3. `getAmountsForLiquidity` returns token1Amount=0, so `newFee1 = n1 * fee1 / (0 + fee1) = n1`.
4. All 100 token1 subtracted from n1 and added to fee1; `increaseLiquidity` succeeds because amount1Min = n1*95/100 is now 0.
**How found:** Code reading of the fee-clawback branch in deposit; noticed getAmountsForLiquidity returns zero for the out-of-range token, making the fee ratio divide by itself and consume the whole deposit.
**Exploitation:** Attacker or market movement pushes Uniswap V3 slot0 price out of the position's tick range between user's tx submission and execution; the deposit then forfeits the entire out-of-range token amount as fee.
**Insight:** When a fee/refund formula divides by a liquidity-derived amount, check the boundary where that amount is zero (price outside tick range) — the ratio collapses to 1 and consumes the full input.