# Bonding Shares Incorrectly Reduced/unstaked on Transfer in launchToken.

LaunchToken._decreaseFeeShares reduces bonding shares by full transfer amount regardless of token origin, so users transferring received tokens lose fee-sharing rights on their original holdings.

- Payout: Contest reward
- Severity: medium
- Program: GTE
- Credited: Web3Vikings
- Disclosed: 2026-02-05
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2025-08-gte-perps-and-launchpad#m-25
- Library page: https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AM-25
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** LaunchToken.sol bonding share accounting
**Root cause:** _decreaseFeeShares subtracts the full transfer amount from bondingShare without distinguishing original purchased tokens from transferred-in tokens, so a holder who transfers received tokens loses shares backing their own original balance.
**Steps:**
1. UserA buys 400M tokens -> 400M bonding shares
2. UserB buys 400M tokens -> 400M bonding shares; token graduates/unlocks
3. UserA transfers 400M to UserB; UserA correctly loses all shares
4. UserB holds 800M tokens but only 400M shares
5. UserB transfers the 400M received tokens to UserC; `_decreaseFeeShares` subtracts 400M from UserB's bondingShare, zeroing it
6. UserB still holds 400M original tokens but has 0 bonding shares and is unstaked from fee rewards
**How found:** Code review of _decreaseFeeShares noticed share reduction keyed to transfer amount rather than origin of tokens, then traced a two-hop transfer scenario to show a holder's original shares get wiped.
**Exploitation:** Any holder who receives tokens then forwards them loses bonding shares on their own original holdings, forfeiting fee-sharing and being unstaked via launchpad.decreaseStake; no attacker capital needed beyond normal transfers.
**Insight:** In share/stake accounting tied to token balances, check whether transfer hooks reduce shares by raw amount without tracking token provenance; multi-hop transfers of received tokens can zero out shares still backing original holdings.