# Lenders lose interests and pay deposit fees due to no slippage control

Ajna's addQuoteToken lacks slippage control, so LUP movement between submission and settlement can charge lenders deposit fees and forfeit interest.

- Payout: Contest reward
- Severity: medium
- Program: Ajna
- Credited: branch_indigo
- Disclosed: 2023-04-20
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-04-ajna-judging/issues/72
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-04-ajna%3AM-1
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:race-window technique:source-review vuln:business-logic vuln:fee-bypass

**Target:** Pool.addQuoteToken / LenderActions deposit logic (Solidity)
**Root cause:** addQuoteToken computes LUP from live deposits_ and poolState_.debt at execution time and charges a deposit fee if the user's index_ is below LUP, with no user-supplied slippage bound; only expiry_ is checked.
**Steps:**
1. Lender calls `addQuoteToken(amount_, index_, expiry_)` with index_ above current LUP (no fee expected).
2. Before settlement, a whale deposit or MEV front-run raises LUP above index_.
3. At execution, `Deposits.findIndexOfSum(deposits_, poolState_.debt)` returns lupIndex < index_, so `depositBelowLup` is true.
4. `addedAmount = Maths.wmul(addedAmount, Maths.WAD - _depositFeeRate(poolState_.rate))` deducts the fee and the deposit earns no interest below HTP.
**How found:** Code review of addQuoteToken: noticed only expiry_ is validated, while LUP is read from live storage at execution, making the fee decision dependent on state the caller cannot bound.
**Exploitation:** MEV searcher observes a pending addQuoteToken and front-runs with a large deposit to push LUP above the victim's index_, causing the victim's deposit to be charged the unutilized deposit fee and earn no interest; no capital extraction to attacker beyond griefing/fee capture.
**Insight:** When a fee/penalty decision depends on a value read from live storage at execution (LUP, utilization, oracle price), check whether the caller can supply a bound on that value; missing bounds are griefable via front-running even without direct profit.