# Liquidation fees are permanently frozen on Penrose YB account

SGL liquidation fees are deposited directly to Penrose's YieldBox account but never counted in refreshPenroseFees, so they are permanently frozen instead of distributed to stakers.

- Payout: Contest reward
- Severity: high
- Program: Tapioca
- Credited: bin2chen
- Disclosed: 2024-02-14
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-02-tapioca-judging/issues/148
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-02-tapioca%3AH-15
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:reward-distribution

**Target:** Singularity market liquidation fee accounting / Penrose fee distribution
**Root cause:** SGLLiquidation._extractLiquidationFees deposits feeShare directly into Penrose's YieldBox balance, but refreshPenroseFees only converts accrueInfo.feesEarnedFraction (interest/borrow fees) into shares, so liquidation fees are never withdrawn or distributed.
**Steps:**
1. Liquidation occurs; _extractLiquidationFees computes feeShare = extraShare - callerShare
2. feeShare is converted to feeAmount and yieldBox.depositAsset(assetId, address(this), address(penrose), feeAmount, 0) credits Penrose's YB balance directly
3. Owner calls withdrawAllMarketFees -> _depositFeesToTwTap -> market.refreshPenroseFees()
4. refreshPenroseFees only mints shares for accrueInfo.feesEarnedFraction and returns _removeAsset(_feeTo, msg.sender, balanceOf[_feeTo])
5. Liquidation fee YB balance on Penrose is never included in feeShares, so it stays frozen
**How found:** Code reading of fee accounting: noticed three fee types (borrow/interest/liquidation) but only interest fees flow through accrueInfo.feesEarnedFraction and refreshPenroseFees; traced _extractLiquidationFees to find it bypasses that path by depositing straight to Penrose's YB account.
**Insight:** When a protocol has multiple fee sources, check that every fee sink is reachable by the single distribution function; a fee deposited directly to a treasury YB/ERC20 balance that the withdraw path doesn't read is permanently stuck.