# User can avoid paying fee on Claim hooks

Superform claim hooks read rewardToken and account from user-supplied data, letting users spoof balanceOf to zero out outAmount and dodge outflow fees.

- Payout: Contest reward
- Severity: medium
- Program: Superform
- Credited: T1MOH
- Disclosed: 2025-07-17
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_superform_may2025.pdf#3.2.17
- Library page: https://bugbountylibrary.com/r/cantina%3Asuperform_may2025%3A3.2.17
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:fee-bypass

**Target:** Claim reward hooks (Fluid/Gearbox/Yearn) in SuperExecutorBase accounting
**Root cause:** _getBalance reads rewardToken and account from attacker-controlled hook data, so outAmount can be forced to 0, and the ledger computes zero fee.
**Steps:**
1. Identify claim hooks (FluidClaimRewardHook, GearboxClaimRewardHook, YearnClaimOneRewardHook) whose _preExecute/_postExecute compute outAmount via _getBalance(data).
2. Craft hook data where rewardToken and account point to a token/account with constant or zero balance (e.g. attacker's own empty account).
3. Execute the claim hook as an OUTFLOW; _postExecute yields outAmount = 0.
4. _updateAccounting passes outAmount=0 to ledger.updateAccounting, producing feeAmount=0, so no fee is charged.
**How found:** Code review of the claim hooks' _preExecute/_postExecute and _getBalance, noticing rewardToken and account are parsed from user-supplied data rather than the smart account or the third-party protocol.
**Exploitation:** User supplies arbitrary rewardToken/account in hook data so the measured balance delta is zero, causing the ledger to record no outflow and skip fee collection on claim hooks.
**Insight:** When a hook measures value via balanceOf of an address parsed from calldata, check whether that address is attacker-chosen; fee/accounting logic keyed on that delta is bypassable by pointing at a zero-balance account.