# Fee unit, count and base bugs

Check each fee's unit, deduction count, and base against the amount that triggered it

_Area: DeFi accounting and math bugs. Seen in 125 disclosed reports; latest 2026-03-09. Updated 2026-10-23._

## How it works
A fee has three independent properties: a unit, a count, and a base. Each can break alone. Unit: the fee is tracked in one denomination (ETH) while the balance it reduces is in another (shares), so it is never rescaled as the exchange rate moves [E2](https://bugbountylibrary.com/r/sherlock%3A2024-08-saffron-finance%3AH-1.md). Count: the same fee term is subtracted in two formulas, or once per operation type instead of once total [E3](https://bugbountylibrary.com/r/sherlock%3A2024-02-perennial-v2-3%3AH-3.md). Base: the fee is computed from an aggregate larger than the quantity that triggered it [E1](https://bugbountylibrary.com/r/c4%3A2024-07-dittoeth%3AH-01.md), from a total that already includes prior fee mints [E8](https://bugbountylibrary.com/r/sherlock%3A2025-07-mellow-flexible-vaults%3AM-4.md), or from an already-decayed value [E7](https://bugbountylibrary.com/r/cantina%3Aprimev_oct2024%3A3.2.12.md). The broken assumption is that every fee component shares one unit, is deducted exactly once, and is measured against the triggering amount.

## Where it shows up
- Fee/earning state stored in a different unit than the balances it is compared against (ETH vs stETH shares) [E2](https://bugbountylibrary.com/r/sherlock%3A2024-08-saffron-finance%3AH-1.md).
- Global aggregation subtracts a fee once per operation type while local subtracts it once total [E3](https://bugbountylibrary.com/r/sherlock%3A2024-02-perennial-v2-3%3AH-3.md).
- Fee base is total debt while the triggering quantity is the discounted trade volume [E1](https://bugbountylibrary.com/r/c4%3A2024-07-dittoeth%3AH-01.md).
- Fee base is a total that already includes previously minted fee shares, so repeated reports compound [E8](https://bugbountylibrary.com/r/sherlock%3A2025-07-mellow-flexible-vaults%3AM-4.md).
- A penalty computed from an already-decayed value instead of original principal [E7](https://bugbountylibrary.com/r/cantina%3Aprimev_oct2024%3A3.2.12.md).
- A rate computed on a reduced base but applied to a full checkpointed amount [E5](https://bugbountylibrary.com/r/sherlock%3A2024-11-autonomint%3AH-17.md).
- A returned payout computed before commission/fee deduction, then used to size a bonus [E6](https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AM-07.md).

## How to review
- For each fee/earning field, list its unit and every arithmetic use; confirm all operands share that unit [E2](https://bugbountylibrary.com/r/sherlock%3A2024-08-saffron-finance%3AH-1.md).
- Compare global vs local fee formulas: confirm the fee is subtracted once total, not once per operation type [E3](https://bugbountylibrary.com/r/sherlock%3A2024-02-perennial-v2-3%3AH-3.md).
- Confirm the fee base equals the quantity that triggered the fee, not a larger aggregate [E1](https://bugbountylibrary.com/r/c4%3A2024-07-dittoeth%3AH-01.md).
- In minted-fee paths, confirm the base is pre-fee principal, not a total already including prior fee mints [E8](https://bugbountylibrary.com/r/sherlock%3A2025-07-mellow-flexible-vaults%3AM-4.md).
- Confirm penalties derive from original principal, not a decayed value [E7](https://bugbountylibrary.com/r/cantina%3Aprimev_oct2024%3A3.2.12.md).
- When a rate uses an adjusted denominator, confirm the multiplier is adjusted the same way [E5](https://bugbountylibrary.com/r/sherlock%3A2024-11-autonomint%3AH-17.md).
- Grep settle/claim/liquidate functions for returned amounts computed before fee deduction [E6](https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AM-07.md).
Invariant: every fee is denominated in the same unit as the balance it reduces, each unit of value is deducted exactly once, and the fee base is the triggering quantity. Test directly: assert fee base == triggering amount; assert global and local fee deductions agree; assert tracked liquidity rises by the minted fee.

## Variants seen
- Fee in underlying, not shares, overstating earnings [E2](https://bugbountylibrary.com/r/sherlock%3A2024-08-saffron-finance%3AH-1.md).
- Global vs local fee double-count [E3](https://bugbountylibrary.com/r/sherlock%3A2024-02-perennial-v2-3%3AH-3.md).
- Fee base larger than triggering volume [E1](https://bugbountylibrary.com/r/c4%3A2024-07-dittoeth%3AH-01.md).
- Fee base includes prior fee mints, compounding [E8](https://bugbountylibrary.com/r/sherlock%3A2025-07-mellow-flexible-vaults%3AM-4.md); same "base too large" mechanism as [E1](https://bugbountylibrary.com/r/c4%3A2024-07-dittoeth%3AH-01.md) at a different scale.
- Penalty from decayed value [E7](https://bugbountylibrary.com/r/cantina%3Aprimev_oct2024%3A3.2.12.md).
- Reduced denominator applied to full multiplier [E5](https://bugbountylibrary.com/r/sherlock%3A2024-11-autonomint%3AH-17.md).
- Return value computed before fee deduction, inflating a bonus [E6](https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AM-07.md).

## Impact and severity
Overstated earnings let early withdrawers take excess funds and leave the vault insolvent [E2](https://bugbountylibrary.com/r/sherlock%3A2024-08-saffron-finance%3AH-1.md); inflated liquidator bonuses [E6](https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AM-07.md); fee avoidance [E7](https://bugbountylibrary.com/r/cantina%3Aprimev_oct2024%3A3.2.12.md); compounding overcharges [E8](https://bugbountylibrary.com/r/sherlock%3A2025-07-mellow-flexible-vaults%3AM-4.md); over-distributed fees draining liquidity [E5](https://bugbountylibrary.com/r/sherlock%3A2024-11-autonomint%3AH-17.md); attacker profit from self-triggered fees [E1](https://bugbountylibrary.com/r/c4%3A2024-07-dittoeth%3AH-01.md). Severity rises when any caller can trigger the drift and it compounds across withdrawals.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2024-07-dittoeth%3AH-01.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2024-08-saffron-finance%3AH-1.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2024-02-perennial-v2-3%3AH-3.md
- E4: https://bugbountylibrary.com/r/c4%3A2024-06-vultisig%3AH-01.md
- E5: https://bugbountylibrary.com/r/sherlock%3A2024-11-autonomint%3AH-17.md
- E6: https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AM-07.md
- E7: https://bugbountylibrary.com/r/cantina%3Aprimev_oct2024%3A3.2.12.md
- E8: https://bugbountylibrary.com/r/sherlock%3A2025-07-mellow-flexible-vaults%3AM-4.md