# Users pay higher fee than intended

Beta Finance reserve-fee share minting divides by pre-interest deposit amount, over-minting reserve shares so lenders pay a higher fee than the configured 10%.

- Payout: Audit contest
- Severity: medium
- Program: Beta Finance
- Found by: T1MOH
- Disclosed: 2023-12-06
- Write-up quality: 7/10
- Original: https://code4rena.com/reports/2023-11-betafinance#m-04
- Library page: https://bugbountylibrary.com/r/c4%3A2023-11-betafinance%3AM-04
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:fee-bypass

**Target:** Tranche deposit/reserve accounting in lending protocol
**Root cause:** reserveShare is computed as reserveInterestAmount * totalDepositShare / trancheDepositAmount_ (pre-interest denominator) instead of dividing by trancheDepositAmount_ + interestAmountProportion, so reserve shares are over-minted and totalDepositAmount is under-increased.
**Steps:**
1. Set Tranche2: 20% APR, 5000 borrowed, 20000 deposited; Tranche1: 10% APR, 10000 borrowed, 20000 deposited; reserveFee 10%.
2. Accrue 1 year: Tranche2 interest 1000, Tranche1 interest 1000; Tranche1 interest split 500/500 by deposit share.
3. Expected reserve fee: 150 (T2) + 50 (T1) = 200; expected user balances 21350 and 20450.
4. Run PoC custom_test2: implementation mints 100 shares to reserve in each tranche and increases totalDepositAmount by 1450 (T2) and 550 (T1).
5. Observe reserve receives 208 total instead of 200; lender bears the 8 extra.
6. Fix: reserveShare = reserveInterestAmount * totalDepositShare_ / (trancheDepositAmount_ + interestAmountProportion) + interestAmountProportion, and handle trancheDepositAmount_==0 by minting reserveInterestAmount + interestAmountProportion.
**How found:** Author set up a concrete two-tranche scenario with round numbers, computed the correct reserve share by solving the balance equations for X (depositAmount delta) and Y (share delta), then compared against the contract's formula and Foundry PoC to show the discrepancy.
**Insight:** When a protocol mints shares to a fee recipient, verify the denominator used for share math includes the just-accrued interest; solving the expected user/reserve balance equations symbolically exposes off-by-interest share inflation that unit tests without reserve-fee assertions miss.