# Fee and discount misclassification in DeFi accounting

Net-vs-gross comparisons, skipped discounts, and time-based premium resets that invert cost or payout

_Area: DeFi accounting and math bugs. Seen in 3 disclosed reports; latest 2025-03-20. Updated 2026-10-29._

## How it works
A pricing or settlement function returns a net amount (after a fee) or applies a discount only on some branches, but a caller treats that number as if it were gross. The assumption that breaks is "returned amount equals expected amount unless value was lost." When a fee is folded into the returned value, any comparison of returned vs expected misreads the fee as a loss [E1](https://bugbountylibrary.com/r/cantina%3Aterm_structure_february2025%3A3.2.8.md). When a discount is skipped on one branch, the user pays full price for less value [E2](https://bugbountylibrary.com/r/c4%3A2023-08-dopex%3AM-11.md). When a premium is derived from a resettable time pointer, the cost collapses to a floor near the reset [E3](https://bugbountylibrary.com/r/c4%3A2023-08-dopex%3AM-12.md). The accounting then drifts from reality: bad debt is overstated, or a user pays more than the asset is worth.

## Where it shows up
- Callers with `returned < expected` or `totalRedeem < ftReserve` branches that treat any shortfall as bad debt or loss [E1](https://bugbountylibrary.com/r/cantina%3Aterm_structure_february2025%3A3.2.8.md)
- Pricing functions with per-branch discounts where one branch (e.g. `rdpxBondId != 0`) skips the discount [E2](https://bugbountylibrary.com/r/c4%3A2023-08-dopex%3AM-11.md)
- Premium or option cost derived from `block.timestamp` against a resettable epoch pointer, so time-to-expiry collapses to a floor near the reset [E3](https://bugbountylibrary.com/r/c4%3A2023-08-dopex%3AM-12.md)

## How to review
For every `returned < expected` branch, confirm whether the callee subtracts a fee before returning; if so, the comparison must add the fee back or compare gross-to-gross. The invariant: a shortfall branch fires only on genuine value loss, never on a known, accounted fee [E1](https://bugbountylibrary.com/r/cantina%3Aterm_structure_february2025%3A3.2.8.md). For pricing, check that every caller path reaching a branch receives the same discount treatment for the same collateral [E2](https://bugbountylibrary.com/r/c4%3A2023-08-dopex%3AM-11.md). For time-based pricing, verify time-to-expiry cannot collapse to a floor by choosing call timing [E3](https://bugbountylibrary.com/r/c4%3A2023-08-dopex%3AM-12.md).

## Variants seen
- Redeem fee misclassified as bad debt, inflating bad-debt mapping and diluting collateral payouts [E1](https://bugbountylibrary.com/r/cantina%3Aterm_structure_february2025%3A3.2.8.md)
- Decaying-bond path skips bond discount, charging full WETH plus premium for fewer tokens [E2](https://bugbountylibrary.com/r/c4%3A2023-08-dopex%3AM-11.md)
- Premium shrinks with time-to-expiry and hits the minimum floor right after a funding epoch [E3](https://bugbountylibrary.com/r/c4%3A2023-08-dopex%3AM-12.md)

## Impact and severity
Overstated bad debt dilutes all collateral claimants, not just the affected user [E1](https://bugbountylibrary.com/r/cantina%3Aterm_structure_february2025%3A3.2.8.md). Skipped discounts cause direct, repeatable user overpayment [E2](https://bugbountylibrary.com/r/c4%3A2023-08-dopex%3AM-11.md); premium timing lets users pay the minimum instead of the full price [E3](https://bugbountylibrary.com/r/c4%3A2023-08-dopex%3AM-12.md). Severity rises when the misclassification is systemic (affects a shared pool) or the timing window is reliably reachable each epoch.

## Why fixes fail
Fixing only the comparison in the caller leaves the callee still returning net amounts, so other callers repeat the error; the fee must be handled consistently at every boundary [E1](https://bugbountylibrary.com/r/cantina%3Aterm_structure_february2025%3A3.2.8.md).

## Evidence
- E1: https://bugbountylibrary.com/r/cantina%3Aterm_structure_february2025%3A3.2.8.md
- E2: https://bugbountylibrary.com/r/c4%3A2023-08-dopex%3AM-11.md
- E3: https://bugbountylibrary.com/r/c4%3A2023-08-dopex%3AM-12.md