# Not considering fees when wrapping mtOFTs leads to DoS in leverage executors

Leverage executors ignore mtOFT wrap fees, so returned amountOut exceeds actual minted tokens, making YieldBox deposit revert and DoS leverage.

- Payout: Contest reward
- Severity: medium
- Program: Tapioca
- Credited: 0xadrii
- Disclosed: 2024-02-14
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-02-tapioca-judging/issues/126
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-02-tapioca%3AM-28
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** BaseLeverageExecutor / SimpleLeverageExecutor wrap flow
**Root cause:** BaseLeverageExecutor._handleToftWrapToSender discards the wrap() return value, so _swapAndTransferToSender returns the pre-fee swap amount even though mtOFT minted amountOut - feeAmount.
**Steps:**
1. Call BBLeverage.buyCollateral with collateral being an mtOFT and swapData.toftInfo.isTokenOutToft=true
2. leverageExecutor.getCollateral -> _swapAndTransferToSender swaps amountIn to amountOut
3. _handleToftWrapToSender wraps amountOut but ignores wrap() return (amountOut - feeAmount)
4. amountOut returned to BBLeverage, converted to collateralShare via yieldBox.toShare
5. yieldBox.depositAsset pulls collateralShare but contract holds less due to fee, reverting
**How found:** Code reading of mTOFT.wrap showing _checkAndExtractFees reduces minted amount, then comparing to leverage executor's _handleToftWrapToSender which ignores wrap() return value.
**Exploitation:** Any user attempting leverage with an mtOFT collateral triggers the mismatch; deposit always reverts, so leverage functionality is unusable for mtOFTs.
**Insight:** When integrating OFT-style wrap/unwrap, always consume the returned minted amount rather than assuming 1:1; fee-on-wrap tokens break downstream accounting that trusts the input amount.