# Malicious users are able to bypass the Tax payment using making a Fake BasicActions Contract

Open Dollar's tax collection lives in BasicActions, which proxies delegatecall to; a user-supplied fake BasicActions skips tax entirely.

- Payout: Contest reward
- Severity: medium
- Program: Open Dollar
- Credited: yashar
- Disclosed: 2023-12-20
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-10-opendollar-findings/issues/286
- Library page: https://bugbountylibrary.com/r/c4%3A2023-10-opendollar%3AM-07
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic

**Target:** ODProxy delegatecall to BasicActions / ODSafeManager
**Root cause:** Tax is collected inside BasicActions, which is invoked via delegatecall from a user-controlled proxy; the proxy can delegatecall to any contract, so a fake BasicActions omitting taxSingle avoids the fee.
**Steps:**
1. Deploy `FakeBasicActions` implementing `lockTokenCollateralAndGenerateDebt`/`generateDebt` without calling `taxCollector.taxSingle`.
2. Encode `abi.encodeWithSelector(fakeBasicActions.lockTokenCollateralAndGenerateDebt.selector, safeManager, taxCollector, collateralJoin[cType], coinJoin, vaultId, 1, 0)`.
3. Call `ODProxy(proxy).execute(address(fakeBasicActions), payload)` as the vault owner.
4. Observe `safeEngine.safes(cType, safeHandler)` shows lockedCollateral=1, generatedDebt=10 with no tax accrued.
**How found:** Code reading: noticed tax is paid inside BasicActions rather than ODSafeManager, and that ODProxy delegatecalls to an arbitrary target supplied by the caller.
**Exploitation:** Attacker deploys a contract replicating BasicActions logic minus taxSingle, then routes their proxy's delegatecall to it, generating debt and exiting COIN while paying zero stability fee.
**Insight:** When fees/accounting live in a helper invoked via delegatecall from a user-controlled proxy, the helper is advisory, not enforced — check whether the state-changing entrypoint itself enforces the fee.