# Protocol fails to charge fees from swap amount

GTE's Uniswap V2 pair swap never deducts the 0.3% fee from balances, letting users swap for free and starving LPs of fees.

- Payout: Contest reward
- Severity: high
- Program: GTE
- Credited: ifex445
- Disclosed: 2026-02-05
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2025-08-gte-perps-and-launchpad#h-10
- Library page: https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AH-10
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:fee-bypass

**Target:** GTELaunchpadV2Pair.sol swap() AMM pair contract
**Root cause:** The swap function computes balance0Adjusted/balance1Adjusted without subtracting the 0.3% fee (amountIn.mul(3)) from balances, and never transfers the fee, so the invariant check passes without any fee being collected.
**Steps:**
1. Call `swap(amount0Out, amount1Out, to, data)` on GTELaunchpadV2Pair with a normal swap amount
2. Observe balance0Adjusted = balance0*1000 - amount0In*3 is computed but the fee is never actually charged/transferred
3. Repeat swaps to extract value while paying zero protocol fee
**How found:** Code review of the swap function against standard Uniswap V2 logic, noticing the fee subtraction term was missing from the adjusted balance computation.
**Exploitation:** Users execute swaps repeatedly; since no fee is deducted from input amounts, they receive full output with no 0.3% LP fee, draining fee revenue from liquidity providers.
**Insight:** When auditing Uniswap V2 forks, diff the swap() adjusted-balance math against canonical UniswapV2Pair: any missing `amountIn.mul(fee)` term means fees are silently skipped.