# Outflow processing is incorrectly skipped when fee percent is 0

Superform skips _processOutflow when feePercent is 0, leaving usersAccumulatorShares and costBasis stale, corrupting later fee accounting once fees are enabled.

- Payout: Contest reward
- Severity: medium
- Program: Superform
- Credited: samuraii77
- Disclosed: 2025-07-17
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_superform_may2025.pdf#3.2.2
- Library page: https://bugbountylibrary.com/r/cantina%3Asuperform_may2025%3A3.2.2
- Tags: domain:web3 impact:integrity kind:contest platform:cantina sev:medium technique:source-review vuln:accounting-error vuln:business-logic

**Target:** Superform yield-source outflow accounting contract
**Root cause:** The outflow branch short-circuits on config.feePercent == 0 and returns before calling _processOutflow, which is the only path that decrements usersAccumulatorShares and usersAccumulatorCostBasis via _calculateCostBasis.
**Steps:**
1. Configure a yield source with feePercent == 0.
2. Call the outflow function with amountSharesOrAssets > 0.
3. Observe the else branch emits AccountingOutflowSkipped and returns 0 without invoking _processOutflow.
4. Check usersAccumulatorShares[user][yieldSource] and usersAccumulatorCostBasis[user][yieldSource]: both remain unchanged despite shares being consumed.
5. Later set feePercent != 0 and perform outflows; fee computation uses the stale accumulator share-to-asset ratio, misallocating fees.
**How found:** Code reading of the outflow branch: noticed the feePercent == 0 early-return skips _processOutflow, then traced into _calculateCostBasis to confirm accumulator decrements live only inside the skipped path.
**Exploitation:** No direct theft path shown; the stale accumulator state causes incorrect fee distribution once a nonzero feePercent is later configured, misattributing fees across users.
**Insight:** When a function early-returns on a 'zero value' shortcut, check whether the skipped callee also performs state bookkeeping unrelated to the zeroed quantity (here accumulator decrements) — zero fee does not mean zero state change.