# Ethena unstaking profit is not subjected to performance fee

EthenaUnstakeHook returns usedShares=0 because shares burn during cooldown, so Superform's performance fee on unstaking yield is never charged.

- Payout: Contest reward
- Severity: high
- Program: Superform
- Credited: Christoph Michel
- Disclosed: 2025-07-17
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_superform_may2025.pdf#3.1.5
- Library page: https://bugbountylibrary.com/r/cantina%3Asuperform_may2025%3A3.1.5
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:business-logic vuln:fee-bypass

**Target:** EthenaUnstakeHook / BaseLedger accounting
**Root cause:** EthenaUnstakeHook measures sUSDE balance delta and reports usedShares=0, but shares were already burned in the prior cooldownShares action; BaseLedger._processOutflow computes costBasis from usedShares, so yield appears zero and no performance fee is taken.
**Steps:**
1. Fork mainnet at block 22543737-1.
2. Deploy EthenaUnstakeHook and build hookData with yieldSource=SUSDE, amount=0.
3. Run _processHook for user 0xDE4a...0776 (tx 0xf2c0...8e6).
4. Observe outAmount>0 but usedShares()==0, so _calculateFees sees costBasis=0 and feeAmount=0.
**How found:** Code review of BaseLedger._processOutflow fee logic vs EthenaUnstakeHook: noticed hook reports usedShares=0 since it measures balance delta, while shares are burned earlier in cooldownShares; confirmed with a mainnet-fork test replaying a real unstake tx.
**Exploitation:** Any user unstaking sUSDE via the hook avoids the performance fee on their yield every time; protocol loses expected fee revenue on a major yield source.
**Insight:** When a hook derives amounts from balance deltas, check whether the share-burn happened in an earlier step; accounting that keys fees off usedShares will silently zero out cost basis and fees.