# The fee logic in slash() is incorrect and in extreme cases will lead to 0 fee, even though provider has enough balance

Primev slash() computes penaltyFee from decayed residualAmt, so late slashing yields zero penalty despite provider stake, letting malicious providers avoid fees.

- Payout: Contest reward
- Severity: medium
- Program: Primev
- Credited: sammy
- Disclosed: 2025-08-27
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_primev_oct2024.pdf#3.2.12
- Library page: https://bugbountylibrary.com/r/cantina%3Aprimev_oct2024%3A3.2.12
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:medium technique:source-review vuln:business-logic vuln:fee-bypass vuln:precision-loss

**Target:** PreconfManager slash() fee accounting
**Root cause:** penaltyFee is derived from residualAmt (already decayed by residualBidPercentAfterDecay) instead of the original bid amt, so as decay approaches zero the penalty fee also approaches zero.
**Steps:**
1. Call slash(amt, provider, bidder, residualBidPercentAfterDecay) with a small residualBidPercentAfterDecay (late confirmation).
2. Observe residualAmt = amt * residualBidPercentAfterDecay * PRECISION / PERCENT becomes tiny or zero.
3. penaltyFee = residualAmt * feePercent * PRECISION / PERCENT also becomes zero.
4. Provider is slashed only residualAmt, protocol receives no penalty fee despite sufficient stake.
**How found:** Code review of slash(): noticed penaltyFee is computed from residualAmt rather than amt, and reasoned that decay drives residualAmt toward zero, zeroing the fee.
**Exploitation:** A malicious provider issues a late bid confirmation so residualBidPercentAfterDecay decays near zero; when the oracle calls slash(), residualAmt and penaltyFee both round to zero, so the provider loses almost nothing and the protocol collects no penalty.
**Insight:** When a penalty is a percentage of an already-decayed or time-scaled value, check whether the decay factor can drive the penalty to zero; fees should be computed from the original principal, not the post-decay remainder.