# Any user can avoid paying most of the protocol fees on short positions, and can unknowingly pay very high fee on long positions

Symmetrical charges LIMIT-order fees on user-supplied price, not execution price, letting shorts dodge fees and longs overpay massively.

- Payout: Contest reward
- Severity: medium
- Program: Symmetrical
- Credited: panprog
- Disclosed: 2023-06-05
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-06-symmetrical-judging/issues/139
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-06-symmetrical%3AM-5
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:fee-bypass

**Target:** symmio-core LibQuote fee calculation for LIMIT quotes
**Root cause:** Protocol fee for LIMIT orders is computed as percentage of quantity * user-supplied requestedOpenPrice (LibQuote.sol L126-130) rather than the actual position openPrice at execution.
**Steps:**
1. Send LIMIT SHORT quote with quantity 500 and price 0.2 while market is 1.0
2. Hedger locks quote and opens position filled at market price 1.0
3. Observe feeCollector balance increases by ~0.2*500*fee instead of 1.0*500*fee
4. Mirror case: LIMIT LONG at price 100000 filled at 1000 charges fee on 100000 notional
**How found:** Code review of LibQuote fee logic noticing fee uses requestedOpenPrice from the quote rather than the execution openPrice, then reasoning about divergence between limit and fill price.
**Exploitation:** PartyA submits LIMIT quote with extreme price far from market; if PartyB fills near market price, fee is still taken on the extreme requested price, so shorts pay near-zero fees (protocol loss) and longs overpay (user loss).
**Insight:** When auditing fee/funding math, check which price variable feeds the notional: user-supplied limit price vs actual fill price divergence is a recurring accounting bug in perp/orderbook protocols.