# Anyone can call StrategySupplyBase.harvest, allowing users to avoid paying performance fees on interest

Permissionless harvest() on StrategySupplyBase lets anyone reset _deployedAmount, so users front-run rebalance to dodge performance fees on interest.

- Payout: Audit contest
- Severity: high
- Program: BakerFi
- Found by: klau5
- Disclosed: 2025-02-26
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2024-12-bakerfi-invitational#h-02
- Library page: https://bugbountylibrary.com/r/c4%3A2024-12-bakerfi-invitational%3AH-02
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic vuln:fee-bypass

**Target:** StrategySupplyBase.harvest (Solidity strategy contract)
**Root cause:** harvest() lacks access control and updates _deployedAmount to current balance, so calling it before the admin's rebalance makes _harvest() return zero balanceChange, skipping fee minting.
**Steps:**
1. Deploy strategy and deposit via `strategySupply.deploy(deployAmount)`.
2. Accrue interest (PoC: `aave3Pool.mintAtokensArbitrarily(strategySupply, deployAmount)`).
3. Call `strategySupply.connect(otherAccount).harvest()` from any account; it emits StrategyProfit and StrategyAmountUpdate and sets `_deployedAmount = newBalance`.
4. Admin's subsequent `rebalance` -> `_harvestAndMintFees` sees balanceChange == 0, so no performance fee shares are minted.
**How found:** Code reading of _harvestAndMintFees/_harvest flow: noticed fee minting depends on balanceChange from _strategy.harvest(), then observed harvest() is external with no access modifier and mutates _deployedAmount.
**Exploitation:** Attacker (any user) front-runs the admin rebalance transaction or periodically calls harvest() so the strategy's _deployedAmount already equals the interest-inclusive balance; the fee-minting branch in _harvestAndMintFees never triggers, letting users keep the full interest instead of paying the performance fee.
**Insight:** When fee or reward accounting depends on a delta computed inside a state-mutating function, check whether that function is permissionless: anyone can zero the delta before the privileged settlement call.