# AuraSpell#closePositionFarm will take reward fees on underlying tokens when borrow token is also a reward

AuraSpell.closePositionFarm burns the BLP before taking the reward fee, so when a reward token equals the borrow token, fees are wrongly cut from the user's underlying liquidity.

- Payout: Contest reward
- Severity: medium
- Program: Blueberry
- Credited: 0x52
- Disclosed: 2023-07-12
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-07-blueberry-judging/issues/103
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-07-blueberry%3AM-6
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:fee-bypass

**Target:** AuraSpell.closePositionFarm (Blueberry Core spell contract)
**Root cause:** closePositionFarm exits the Balancer pool (burning BLP and returning underlying tokens) before calling _doCutRewardsFee on reward tokens; when a reward token overlaps the borrow token, the fee cut applies to the user's redeemed underlying liquidity instead of only rewards.
**Steps:**
1. Open a position via AuraSpell where the borrow token is also one of the pool's reward tokens.
2. Call `closePositionFarm`; observe `wAuraPools.getVault(lpToken).exitPool(...)` redeems BLP into underlying tokens first.
3. Then the reward loop calls `_doCutRewardsFee(sellToken)` for each reward token, including the borrow token now present as underlying.
4. Fee is taken from the user's principal/underlying, overcharging the user.
**How found:** Code reading of closePositionFarm ordering: noticed BLP is burned via exitPool before the reward fee loop, and reasoned that overlap between reward tokens and borrow token causes the fee to hit underlying liquidity; compared against ConvexSpell which sells rewards before burning.
**Insight:** When auditing reward-fee logic, check the ordering of pool exit/burn versus fee deduction and whether reward token sets can overlap borrow/underlying tokens; a correct sibling implementation (ConvexSpell) reveals the intended order.