# Fee receiver is given twice the amount of borrow fees it's owed

GMX PositionPricingUtils double-counted borrowingFeeAmount in totalNetCostAmount, charging users twice the fee-receiver portion of borrow fees.

- Payout: Contest reward
- Severity: high
- Program: Gmx
- Credited: IllIllI
- Disclosed: 2022-09-22
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-02-gmx-judging/issues/135
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AH-12
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:solidity technique:source-review vuln:accounting-error vuln:fee-bypass

**Target:** PositionPricingUtils.getPositionFees in gmx-synthetics
**Root cause:** totalNetCostAmount sums both feeReceiverAmount (which already includes borrowingFeeAmountForFeeReceiver) and the full borrowingFeeAmount, double-counting the fee-receiver share of borrow fees.
**Steps:**
1. Open PositionPricingUtils.getPositionFees()
2. Observe borrowingFeeAmount = getBorrowingFees()/price
3. borrowingFeeAmountForFeeReceiver = applyFactor(borrowingFeeAmount, factor)
4. feeReceiverAmount += borrowingFeeAmountForFeeReceiver
5. totalNetCostAmount adds feeReceiverAmount + borrowingFeeAmount, double counting the receiver share
6. User is charged twice the receiver portion; fee receiver receives twice what is owed
**How found:** Manual review of fee accounting in PositionPricingUtils, noticing borrowingFeeAmount is included in totalNetCostAmount while feeReceiverAmount already contains its receiver share.
**Exploitation:** Any position change (increase/decrease/swap) triggers getPositionFees; the inflated totalNetCostAmount is deducted from the user's collateral, overpaying the fee receiver by the borrowingFeeAmountForFeeReceiver amount.
**Insight:** In fee-accounting code, check whether a gross fee variable and its already-split sub-components are both summed into a total; double-counting of a split component is a common accounting bug.