# Penalty fees can be shared among future farms or expired farms, risks of exploits

Penalty fees from emergency withdrawals are split across all farms sharing an lp_denom, including future and expired farms, letting a malicious farm creator siphon shares.

- Payout: Audit contest
- Severity: medium
- Program: MANTRA
- Credited: oakcobalt
- Disclosed: 2025-03-31
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2024-11-mantra-dex#m-02
- Library page: https://bugbountylibrary.com/r/c4%3A2024-11-mantra-dex%3AM-02
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:business-logic vuln:fee-bypass vuln:reward-distribution

**Target:** CosmWasm farm-manager contract (withdraw_position / get_farms_by_lp_denom)
**Root cause:** withdraw_position divides the owner penalty fee commission among all unique farm owners returned by get_farms_by_lp_denom, which indexes farms by lp_denom without filtering by epoch status (current, future, expired).
**Steps:**
1. Create a valid future farm with a popular lp_denom that already has an active farm, paying the flat pool creation fee.
2. Wait for emergency withdraw_position calls on positions of that lp_denom before the new farm's epoch starts.
3. Penalty fee commission is split equally across all unique farm owners including the malicious future farm.
4. Collect share (1/2 * total owner penalty fees minus creation fee > 0), then close_farm to reclaim deposited assets.
**How found:** Code review of withdraw_position traced into get_farms_by_lp_denom and noticed the index query returns farms regardless of epoch status, then reasoned about who benefits from the split.
**Exploitation:** Malicious farm creator registers a future farm on a popular lp_denom; every emergency withdrawal splits owner penalty fees across all farms including the inactive one, so the attacker collects shares without contributing rewards, then closes the farm to recover assets.
**Escalation:** Attacker can also target existing farms with frequent emergency withdrawals driven by bugs or market conditions to maximize collected shares.
**Insight:** When a fee or reward is split among a set of participants, check whether the participant-selection query filters by lifecycle state (active/expired/future); index-based lookups often return stale or not-yet-active entries that can be registered cheaply.