# Fee share calculation is incorrect

Surge Pool mints fee shares using fee*totalSupply/supplied, over-minting shares to feeRecipient and diluting LP interest.

- Payout: Contest reward
- Severity: medium
- Program: Surge
- Credited: 0x52
- Disclosed: 2023-02-18
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-02-surge-judging/issues/113
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-02-surge%3AM-4
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:reward-distribution

**Target:** Pool.sol fee accrual / share minting
**Root cause:** Fee shares computed as fee*totalSupply/supplied ignores that the fee is paid out of interest and that new shares dilute existing holders, so the denominator is too small.
**Steps:**
1. Set _supplied=100, _totalSupply=100, _interest=10, fee=2
2. Current: _accruedFeeShares = 2*100/100 = 2 shares
3. Value of 2 shares = 2*110/102 = 2.156 > intended fee 2
4. Correct: _accruedFeeShares = (_totalSupply*fee)/(_supplied+_interest-fee) = 200/108 = 1.852, worth 1.852*110/101.852 = 2
**How found:** Code review of the fee accrual equation; verified by plugging sample numbers and comparing share value before/after minting.
**Exploitation:** Passive: every interest accrual over-mints fee shares to feeRecipient, systematically diluting LP returns; no attacker action needed.
**Insight:** When fees are paid by minting shares into an interest-bearing pool, the denominator must account for the interest being distributed and the dilution from the new shares themselves; test the equation by computing post-mint share value, not just share count.