# User may not receive profit from withdrawal fee as expected and attacker can steal value from pool

Mellow Vault batch withdrawal uses constant totalSupply/totalValue, so withdrawal fees accrue only after the batch, letting an attacker front-run a large batch to mint LP and steal fee value.

- Payout: Contest reward
- Severity: medium
- Program: Mellow
- Credited: Ironsidesec
- Disclosed: 2024-06-04
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-06-mellow-judging/issues/162
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-06-mellow%3AM-2
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:chained technique:source-review vuln:business-logic vuln:fee-bypass vuln:oracle-manipulation

**Target:** Vault.sol processWithdrawals / analyzeRequest
**Root cause:** calculateStack snapshots totalSupply and totalValue once; analyzeRequest computes expectedAmounts from these constants, so fees charged during the batch do not raise LP value until all requests are processed and LP burned.
**Steps:**
1. Observe processWithdrawals processes a batch using a single ProcessWithdrawalsStack with fixed totalSupply/totalValue.
2. Attacker front-runs a large batch withdrawal by depositing/minting LP tokens.
3. Batch processes: each request's expectedAmounts = lpAmount*totalValue/totalSupply*(1-fee)/ratios, ignoring fees paid earlier in the batch.
4. LP tokens burned at end of batch, raising LP share price; attacker back-runs to withdraw at appreciated value, capturing a share of all fees.
**How found:** Code reading of calculateStack/analyzeRequest: noticed totalSupply and totalValue are snapshotted and never updated per-request, so fees charged mid-batch don't affect subsequent expectedAmounts, enabling front-run/back-run fee capture.
**Exploitation:** Attacker deposits large capital before a large queued batch withdrawal, waits the withdrawal delay, then exits after the batch, receiving a pro-rata share of the accumulated withdrawal fees without being a long-term depositor; profitable when >~50% of vault TVL is withdrawn in one batch.
**Escalation:** Repeat on every large batch withdrawal to compound stolen fees; larger attacker capital yields larger profit and larger loss to honest depositors.
**Insight:** In batch-processing loops, check whether share-price/accounting state is snapshotted once and not mutated per iteration; any fee or value change applied only after the loop is a MEV sniping surface for front-run deposits.