# Borrow fees can be arbitrarily increased without the maker providing any value

SpotHedgeBaseMaker LPs inflate their utilization ratio via offsetting maker trades, raising borrow fees paid by traders without providing liquidity.

- Payout: Contest reward
- Severity: medium
- Program: Perpetual
- Credited: IllIllI
- Disclosed: 2024-02-19
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-02-perpetual-judging/issues/126
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-02-perpetual%3AM-10
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic

**Target:** BorrowingFee / LibBorrowingFee utilization ratio accounting
**Root cause:** Utilization ratio increases whenever a maker's open notional grows, regardless of whether the taker is merely offsetting an existing position; whitelisted makers pay no fee themselves, so they can inflate their own ratio for free.
**Steps:**
1. Open a position against OracleMaker (e.g. `clearingHouse.openPosition` with maker=oracle_maker, isBaseToQuote=false, amount=1e18).
2. Wait ~2s (one Optimism block).
3. Close the position against SpotHedgeBaseMaker via `openPosition` with maker=maker, isBaseToQuote=true, isExactInput=true, amount=1e18.
4. Observe `borrowingFee.getUtilRatio` short ratio jump from 0 to ~0.9959 at a cost of ~0.000128% of capital.
5. Repeat in small amounts to push ratio arbitrarily; hold SHBM LP to collect inflated fees.
**How found:** Code reading of LibBorrowingFee.updateReceiverUtilRatio: utilization only tracks maker open notional increase, not whether the taker is reducing a position; combined with BorrowingFee.getPendingFee exempting receivers from paying fees.
**Exploitation:** Attacker opens a position on OracleMaker then immediately offsets it against SpotHedgeBaseMaker, leaving no net position but inflating SHBM's utilization ratio. As an SHBM LP, the attacker collects borrow fees proportional to that ratio, paid by traders on the opposite side.
**Escalation:** Repeatable in small increments to avoid Uniswap slippage; ratio persists until market forces rebalance.
**Insight:** When a fee/rebate formula keys off a maker's open notional, check whether a taker can grow that notional while netting to zero elsewhere — offsetting trades across two whitelisted makers can inflate the ratio for free.