# Economic Overcharge — Fee Charged on Gross Profit Before Buffer Refill in _handlePosi- tiveYield() of YieldSharing

YieldSharing charges performance fee on gross yield before refilling safety buffer, letting manager take up to 20% while users get nothing.

- Payout: Contest reward
- Severity: medium
- Program: infiniFi
- Credited: Rolando
- Disclosed: 2025-05-23
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_infinifi_april2025.pdf#3.2.22
- Library page: https://bugbountylibrary.com/r/cantina%3Ainfinifi_april2025%3A3.2.22
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:medium tech:solidity technique:source-review vuln:business-logic vuln:fee-bypass

**Target:** YieldSharing.sol _handlePositiveYield() accounting logic
**Root cause:** Performance fee is deducted immediately after minting gross yield, before the safety buffer top-up, so fee applies to non-distributable profit.
**Steps:**
1. Set safetyBufferSize=10e18 and performanceFee=0.199e18 via parametersAddress
2. Mock 5 USDC profit (oracle 0.5) so accrue() mints 10 iUSD
3. Call yieldSharing.accrue()
4. Observe fee recipient receives 1.99 iUSD while contract holds 8.01 iUSD, below buffer target
5. Assert siUSD and lockingController balances remain 0
**How found:** Code reading of _handlePositiveYield() ordering: noticed fee block executes before safety-buffer top-up branch, contradicting documented 'fee on net positive yield' norm (Euler Earn, high-water-mark).
**Exploitation:** Manager (or anyone triggering accrue) benefits: each profitable harvest while buffer is under target transfers up to 20% of gross yield to performanceFeeRecipient, permanently removing capital meant for first-loss buffer and zeroing user returns.
**Escalation:** Repeatable on every accrue() call while buffer is below target, compounding over time and weakening peg protection.
**Insight:** In yield/accounting contracts, check the ordering of fee deduction vs. loss-absorption/coverage mechanisms (buffer, high-water mark); fee must apply to post-coverage net yield, not gross minted amount.