# 0.3% of numeraire will be lost if protocol does not reach minimum minimumProceeds

Doppler's insufficient-proceeds clearing ignores Uniswap pool fees, leaving 0.3% of numeraire permanently stuck in the manager after buyers sell back.

- Payout: Contest reward
- Severity: medium
- Program: Doppler
- Credited: deadrosesxyz
- Disclosed: 2025-02-18
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_doppler.pdf#3.2.1
- Library page: https://bugbountylibrary.com/r/cantina%3Adoppler%3A3.2.1
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:fee-bypass

**Target:** Uniswap v4 hook / auction manager clearing logic
**Root cause:** When minimumProceeds is not reached, all numeraire is placed as liquidity at the average clearing price without accounting for the 0.3% pool swap fee, so the fee portion cannot be recovered by sellers.
**Steps:**
1. Deploy auction with minimumProceeds set above achievable proceeds and pool fee 0.3%.
2. `vm.warp(hook.getStartingTime()); buy(1e18);`
3. `vm.warp(hook.getEndingTime());` so minimumProceeds is unmet and `_clearPositions`/`_computeLowerSlugInsufficientProceeds` runs.
4. `sell(-1e18);` to sell back all tokens.
5. Observe `TestERC20(numeraire).balanceOf(address(manager))` is nonzero: 0.3% of numeraire remains stuck.
**How found:** Reviewer read the insufficient-proceeds branch that adds all numeraire as liquidity at average clearing price and noticed pool fees were not subtracted, then confirmed with a buy/sell PoC showing residual balance.
**Exploitation:** Not an attack; the loss occurs naturally whenever an auction fails to reach minimumProceeds and buyers exit, leaving fee-denominated numeraire trapped in the manager.
**Insight:** When a contract recycles user funds through an AMM at a computed clearing price, check whether swap fees are deducted from the liquidity math; failed-auction refund paths are where fee leakage hides.