# `depositFee` can be bypassed via deposit queue

Deposit fee on Y2K Carousel can be bypassed by queueing a deposit then minting it via mintDepositInQueue in the same transaction, paying zero fee.

- Payout: Contest reward
- Severity: high
- Program: Y2K
- Credited: 0xRobocop
- Disclosed: 2023-03-06
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-03-Y2K-judging/issues/75
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-03-Y2K%3AH-3
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:solidity technique:source-review vuln:business-logic vuln:fee-bypass

**Target:** Carousel.sol deposit/mintDepositInQueue
**Root cause:** Direct deposits pay a dynamic depositFee, but queue deposits minted via mintDepositInQueue do not apply the depositFee, so routing through the queue avoids it.
**Steps:**
1. Ensure depositFee is non-zero and epoch _id=1 is valid.
2. Deploy a contract that calls `deposit(0, _assets, 0xAlice)` to enqueue the deposit.
3. In the same tx call `mintDepositInQueue(1, 1)`; FILO ordering processes Alice's deposit first.
4. Alice receives shares paying zero depositFee and pockets the relayerFee.
**How found:** Code review of Carousel deposit path: noticed depositFee applied only on direct deposit while mintDepositInQueue lacked the fee, and FILO ordering lets a self-mint happen in the same tx.
**Exploitation:** Attacker bundles queue deposit and mintDepositInQueue in one transaction at epoch end, exploiting FILO ordering to have their deposit minted immediately without incurring the dynamic depositFee, capturing the relayerFee instead.
**Insight:** When a protocol has two entry paths (direct vs queued) with different fee logic, check whether the cheaper path can be self-served in the same transaction to skip the fee; FILO/LIFO queue ordering enables immediate self-mint.