# Inaccurate value is used for partial fill quote amount when calculating fees

Axis Finance settle() overestimates partial-fill quote input via mulDivDown, allocating more fees than claimProceeds captures, so reward or proceeds claims revert.

- Payout: Contest reward
- Severity: medium
- Program: Axis Finance
- Credited: hash
- Disclosed: 2024-03-14
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-03-axis-finance-judging/issues/182
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-03-axis-finance%3AM-6
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:precision-loss

**Target:** AuctionHouse.sol settle/claimBids/claimProceeds fee accounting
**Root cause:** Partial-fill quote contribution is derived as mulDivDown(pfPayout, totalIn, totalOut) instead of bidAmount - pfRefund, which rounds up relative to the actual contribution and inflates allocated fees.
**Steps:**
1. Set marginalPrice=2556460687578254783645, capacity=1056499719758481066, previousTotalAmount=1e18, bidAmount=2999999999999999999997.
2. Compute fullFill=mulDivDown(bidAmount,1e18,marginalPrice), excess=capacityExpended-capacity, pfPayout=fullFill-excess, pfRefund=mulDivDown(bidAmount,excess,fullFill).
3. totalAmountIn=previousTotalAmount+bidAmount-pfRefund; usedContributionForQuoteFees=mulDivDown(pfPayout,totalAmountIn,totalOut).
4. Assert actualContribution (bidAmount-pfRefund) < usedContributionForQuoteFees.
5. Compare calculateQuoteFees(1e3,0,false,totalAmountIn) vs sum of fees on previousTotalAmount and usedContributionForQuoteFees; assert sum > captured.
6. Run `forge test --mt testHash_SpecificPartialRounding -vv`.
**How found:** Code reading of settle()'s partial-fill fee allocation versus claimProceeds() fee capture; noticed the mulDivDown reconstruction of input amount could exceed the true contribution, then built a numeric PoC to confirm fee over-allocation.
**Exploitation:** No attacker action; rounding mismatch means sum of allocated protocol/referrer rewards plus seller proceeds exceeds quote tokens held, so whichever claim executes last reverts for lack of tokens.
**Insight:** When fees are allocated per-bid at claim time but captured in aggregate at settle time, any rounding in reconstructing per-bid input amounts can make the two totals diverge; check that per-bid fee bases sum to the aggregate base exactly.