# AutoRange execution can be front-ran to avoid protocol fee, causing loss for protocol

AutoRange operator's rewardX64 is set from user's onlyFees config, but user can front-run to flip onlyFees, cutting protocol fee from 0.15% of position to 0.15% of collected fees.

- Payout: Contest reward
- Severity: medium
- Program: Revert Lend
- Credited: 0xjuan
- Disclosed: 2024-05-22
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2024-03-revert-lend-findings/issues/110
- Library page: https://bugbountylibrary.com/r/c4%3A2024-03-revert-lend%3AM-23
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:race-window vuln:business-logic vuln:fee-bypass

**Target:** AutoRange.execute() transformer with rewardX64 fee parameter
**Root cause:** Operator computes rewardX64 off-chain from the user's PositionConfig.onlyFees, but onlyFees is user-mutable and read at execution time, so the on-chain fee logic can diverge from the rewardX64 the operator signed off on.
**Steps:**
1. User configures position with `onlyFees=false` (0.15% of entire position fee).
2. Operator builds `AutoRange.execute(..., rewardX64)` sized for 0.15% of full position and submits tx.
3. User front-runs by setting `onlyFees=true` (0.15% of collected fees only).
4. Operator tx lands; protocol collects 0.15% of fees instead of 0.15% of position, far below swap cost.
**How found:** Reading AutoRange.sol rewardX64 handling alongside the docs on fee sources, noticing rewardX64 is derived from a user-controlled config flag that is not bound to the operator's transaction.
**Exploitation:** User watches mempool for operator's execute() call, submits a config-change tx with higher gas to flip onlyFees before it, then lets the operator's unchanged rewardX64 execute against the cheaper fee mode, shifting cost onto the protocol.
**Insight:** When an off-chain operator prices a reward from user-controlled config, check whether that config can change between pricing and execution; any mutable flag feeding fee math is a front-run lever.