# A subject creator within a single block can claim holder fees without holding due to unprotected reentrancy path

Curves subject creator reenters via subject-fee call to burn locked tokens, claim holder fees without holding, then re-lock.

- Payout: Contest reward
- Severity: medium
- Program: Curves Protocol
- Credited: nuthan2x
- Disclosed: 2024-07-19
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2024-01-curves-findings/issues/386
- Library page: https://bugbountylibrary.com/r/c4%3A2024-01-curves%3AM-06
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:reentrancy vuln:reward-distribution

**Target:** Curves.sol _transferFees / FeeSplitter.claimFees
**Root cause:** _transferFees sends subject/referral fees with call, allowing the subject to reenter during a buy/sell; holder fee credit is updated after the external call, so the reentrant burn of locked tokens lets them claim holder fees without holding.
**Steps:**
1. Buy curves and withdraw/mint external tokens, locking them in a bridge/AMM (keep 1 curve).
2. Wait for a normal user buy/sell; _transferFees calls the subject with subjectFee.
3. In receive(), deposit/burn the external tokens back to curves to inflate balance.
4. Call feeSplitter.claimFees(subject) to claim holder fees for the inflated balance.
5. Withdraw/mint external tokens again to re-lock; repeat every other buy/sell cycle.
**How found:** Code reading of _transferFees: noticed subject/referral fees sent via call instead of transfer, and holder fee credit updated after the external call, enabling reentrancy to claim fees without holding.
**Exploitation:** Subject creator holds external tokens in a bridge/AMM; on receiving subject fee via call, reenters to burn those tokens into curves, claims holder fees with the temporarily inflated balance, then re-locks by minting/withdrawing. Only possible once per buy/sell cycle because holder fee credit updates after the subject fee transfer.
**Insight:** When a fee/credit is updated after an external call to a user-controlled address, check whether the user can temporarily inflate their balance (e.g., by burning locked tokens) to claim the credit before the state update.