# outAmount Doesn't Account for Fee in Chained Hook Execution

Superform OUTFLOW hooks deduct a fee without reducing reported outAmount, so chained hooks using usePrevHookAmount receive inflated input and revert or over-spend.

- Payout: Contest reward
- Severity: medium
- Program: Superform
- Credited: Aamirusmani1552
- Disclosed: 2025-07-17
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_superform_may2025.pdf#3.2.5
- Library page: https://bugbountylibrary.com/r/cantina%3Asuperform_may2025%3A3.2.5
- Tags: domain:web3 impact:dos impact:integrity kind:contest platform:cantina sev:medium tech:evm tech:solidity technique:chained technique:source-review vuln:business-logic vuln:fee-bypass

**Target:** Superform Hooks executor (ERC4626 redeem/deposit hooks)
**Root cause:** OUTFLOW hooks deduct a fee from the user's asset balance in _updateAccounting but do not reduce the hook's reported outAmount, so chained hooks consuming usePrevHookAmount get an inflated value.
**Steps:**
1. Deploy ApproveAndRedeem4626VaultHook and ApproveAndDeposit4626VaultHook; deposit 1000e18 tokens via deposit hook to get shares.
2. Donate tokens to the vault to create profit so redemption incurs a 10% fee.
3. Build a 2-hook entry: hook0 = redeem with `usePrevHookAmount=false`, hook1 = deposit with `usePrevHookAmount=true`.
4. Execute via `superSourceExecutor.execute(abi.encode(entry))`; the deposit hook receives the pre-fee outAmount, exceeding the account's post-fee balance.
5. Observe revert `ERC20InsufficientBalance(account, amountReceivedAfterFee, sharesToAssetBeforeFee)` (or silent over-spend if extra tokens exist).
**How found:** Reviewer read _updateAccounting fee logic and noticed outAmount is set in _preExecute before fee deduction, then reasoned about the usePrevHookAmount chaining path with ERC4626 redeem hooks that charge profit fees.
**Exploitation:** User chains an OUTFLOW redeem hook into a subsequent hook with usePrevHookAmount=true; the fee is taken from the account but outAmount still reports the gross amount, so the next hook pulls more than available, reverting the whole tx (DoS) or spending the user's other tokens unexpectedly.
**Insight:** When auditing hook/pipeline systems with a 'use previous output' flag, check whether any post-execution accounting (fees, slippage, rebasing) mutates balances after outAmount is snapshotted — the chained consumer will see stale gross values.