# Fees aren't distributed properly for positions with multiple lenders, causing loss of funds for lenders

Fee distribution in LiquidityBorrowingManager divides fees by total borrowed amount, letting new lenders in an increased position steal uncollected fees from earlier lenders.

- Payout: Contest reward
- Severity: high
- Program: Leverage Contracts
- Credited: 0xDetermination
- Disclosed: 2024-02-22
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-02-leverage-contracts-judging/issues/41
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-02-leverage-contracts%3AH-1
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:solidity technique:source-review vuln:business-logic vuln:reward-distribution

**Target:** LiquidityBorrowingManager.sol harvest()/repay() fee accounting
**Root cause:** feesAmt = feesOwed * holdTokenDebt / borrowedAmount uses the current total borrowed amount, so a newly added lender's share is computed against fees accrued before they lent, diluting older lenders' uncollected fees.
**Steps:**
1. Borrower opens a position; fees accrue but are not distributed until harvest()/repay().
2. Borrower increases the position via borrow() with a new lender; borrow() does not harvest existing fees.
3. harvest() or repay() computes `feesAmt = FullMath.mulDiv(feesOwed, cache.holdTokenDebt, borrowedAmount)` crediting the new lender a share of pre-existing fees.
4. Older lenders receive less than owed; attacker can open a proportionally large loan to capture most fees.
**How found:** Code reading of the fee formula in harvest()/repay(); noticed borrow() never distributes fees, so the denominator borrowedAmount grows after fees accrue, misweighting shares.
**Exploitation:** Borrower with a position holding large uncollected fees opens a proportionally large loan from a colluding lender, then triggers harvest()/repay() so the new lender is credited a share of the accrued fees, siphoning value from honest lenders.
**Insight:** When a share formula divides by a mutable total (total borrowed/lent), check whether that total can change between accrual and distribution; any path that adds principal without first settling accrued rewards dilutes existing participants.