# Fees are ignored when checks skew max in Stable Withdrawal /  Leverage Open / Leverage Adjust

Flatmoney skew-max check ignores withdraw/trade fees, so safe stable withdrawals and leverage opens/adjusts revert when skew fraction is near the max.

- Payout: Contest reward
- Severity: medium
- Program: Flatmoney
- Credited: HSP
- Disclosed: 2023-12-11
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-12-flatmoney-judging/issues/92
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-12-flatmoney%3AM-1
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** StableModule / LeverageModule skew check (Solidity vault)
**Root cause:** checkSkewMax is called after updating stable collateral but before the withdraw/trade fee is settled back into the vault, so the fee amount is not counted toward the skew calculation.
**Steps:**
1. Set skewFractionMax=120%, stableWithdrawFee=1%.
2. Alice deposits 100 collateral; Bob opens leverage with additionalSize 100 -> skew 0, skewFraction 100%.
3. Alice withdraws 16.8; withdrawFee=0.168; expected skewFraction 119.5% (< max).
4. checkSkewMax runs with additionalSkew=0 before fee settlement, computes 120.19% and reverts.
5. Same pattern in LeverageModule open/adjust where tradeFee is excluded from the skew check.
**How found:** Code reading of StableModule.withdraw: noticed updateStableCollateralTotal(-amountOut) then checkSkewMax before the fee is added back via updateStableCollateralTotal(withdrawFee); confirmed with a Foundry test computing actual skew fraction.
**Insight:** When a fee is deducted from a user's balance but retained in the vault, any invariant check placed between the deduction and the fee re-credit will see a transiently wrong state; audit ordering of state updates vs. invariant checks around fee settlement.