# Users can avoid performance fees by withdrawing before the end of the epoch forcing other users to pay their fees

Knox vault charges performance fees at epoch end on adjusted assets including early withdrawals, letting withdrawers dodge fees while remaining users pay them.

- Payout: Contest reward
- Severity: medium
- Program: Knox
- Credited: 0x52
- Disclosed: 2022-09-21
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2022-09-knox-judging/issues/75
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-09-knox%3AM-4
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:fee-bypass

**Target:** ERC4626-style vault performance fee accounting
**Root cause:** Performance fee is computed on _totalAssets() + l.totalWithdrawals at epoch end, but withdrawals during the epoch are not charged the fee, so their value inflates netIncome and the fee is paid from remaining vault collateral, diluting other users' share price.
**Steps:**
1. Deposit into Knox vault before epoch end.
2. Withdraw full position mid-epoch; no performance fee is deducted on withdrawal.
3. At epoch settlement, `adjustedTotalAssets = _totalAssets() + l.totalWithdrawals` includes the withdrawn value, inflating `netIncome`.
4. `feeInCollateral = performanceFee * netIncome` is transferred from vault collateral, reducing share price for remaining holders.
**How found:** Code review of the fee-settlement logic in VaultInternal.sol, noticing that totalWithdrawals is added to adjusted assets for fee computation while withdrawals themselves bypass the fee.
**Exploitation:** A depositor times a full withdrawal before epoch settlement to capture gains fee-free; the fee is still levied on the inflated adjusted assets and paid from vault collateral, shifting the cost onto remaining depositors.
**Insight:** When a fee is computed at settlement from a snapshot that includes already-exited balances, check whether the exiting path itself is charged; any value counted in the fee base but not debited at exit is a fee-avoidance/dilution vector.