# Strategists are paid 10x the vault fee because of a math error

Astaria PublicVault divides strategist fee by 1000 instead of 10000 BPS, paying strategists 10x the set vault fee at users' expense.

- Payout: Contest reward
- Severity: high
- Program: Astaria
- Credited: obront
- Disclosed: 2022-11-07
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2022-10-astaria-judging/issues/49
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-10-astaria%3AH-32
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:fee-bypass

**Target:** PublicVault.sol _handleStrategistInterestReward (Solidity vault contract)
**Root cause:** Vault fee is stored in basis points (x/10,000) but the fee calculation divides by 1,000, inflating the strategist reward 10x.
**Steps:**
1. Payment to public vault triggers beforePayment() -> _handleStrategistInterestReward(lienId, amount).
2. Compute x = min(amount, LIEN_TOKEN().getInterest(lienId)).
3. fee = x.mulDivDown(VAULT_FEE(), 1000) — divides by 1000 instead of 10000.
4. strategistUnclaimedShares += convertToShares(fee), crediting 10x intended fee.
5. With VAULT_FEE=1000 (10%), fee = amount*1000/1000 = full amount to strategist.
**How found:** Code review of the fee math in _handleStrategistInterestReward, noticing the divisor 1000 mismatched the documented BPS (10,000) convention.
**Exploitation:** A strategist sets a vault fee; every payment computes fee with /1000, so strategist accrues 10x the intended share, draining value from depositors. VAULT_FEE is immutable via ClonesWithImmutableArgs, so it cannot be corrected post-deployment.
**Escalation:** Immutability of VAULT_FEE means the mispriced fee persists for the vault's lifetime, turning a config error into irretrievable user fund loss.
**Insight:** When a value is documented as basis points, grep every division/multiplication against it for a mismatched denominator (1000 vs 10000); also check whether the misconfigured parameter is immutable, which upgrades severity from medium to high.