# Inflated fee and slash base

Check whether a fee, reward or slash base includes amounts that are no longer eligible

_Area: DeFi accounting and math bugs. Seen in 3 disclosed reports; latest 2024-11-26. Updated 2026-10-29._

## How it works
A fee, reward or penalty is computed as `rate × base`. The base is supposed to contain only amounts that are actually eligible. The bug is that the base is built from a broader quantity — total assets, all positions, a full checkpointed amount — while the rate or the exclusion was derived for a narrower one. The mismatch inflates the payout or charge beyond what the eligible amount justifies.

## Where it shows up
- A `collect`/`withdraw` call using `type(uint128).max` or any sentinel instead of the per-position owed amount [E1](https://bugbountylibrary.com/r/c4%3A2024-06-vultisig%3AH-01.md)
- A denominator reduced for one variable (e.g. subtracting `downsideProtected`) while the multiplier still uses the full checkpointed amount [E2](https://bugbountylibrary.com/r/sherlock%3A2024-11-autonomint%3AH-17.md)
- A slash or fee base read from `totalAssets()` that still counts assets whose eligibility window has expired [E3](https://bugbountylibrary.com/r/c4%3A2024-07-karak%3AM-03.md)
- Any place a rate is computed on one base and applied to another

## How to review
Identify the eligible set for each fee/slash computation and confirm the base equals exactly that set. Check that every exclusion applied to the rate is also applied to the base (or vice versa). For position wrappers, confirm collection is bounded by the specific tokenId's owed fees, not a max sentinel [E1](https://bugbountylibrary.com/r/c4%3A2024-06-vultisig%3AH-01.md). For time-windowed penalties, confirm assets past the window are removed from the base before multiplying [E3](https://bugbountylibrary.com/r/c4%3A2024-07-karak%3AM-03.md). The invariant: `base == sum of eligible amounts` at the moment of multiplication.

## Variants seen
- Over-collection from shared pool: max-sentinel collect sweeps all positions' fees to one recipient, bricking later claims [E1](https://bugbountylibrary.com/r/c4%3A2024-06-vultisig%3AH-01.md)
- Base/multiplier mismatch: reduced base, full multiplier, over-crediting fees [E2](https://bugbountylibrary.com/r/sherlock%3A2024-11-autonomint%3AH-17.md)
- Stale eligibility: expired-window assets remain in slash base, over-slashing [E3](https://bugbountylibrary.com/r/c4%3A2024-07-karak%3AM-03.md)

## Impact and severity
High. E1 blocks most users from claiming and misdirects fees; E2 over-distributes fees and drains liquidity; E3 lets a slasher take more than its allowed percentage. Severity rises when the inflated base is shared across users, so one actor's action consumes others' entitlements.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2024-06-vultisig%3AH-01.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2024-11-autonomint%3AH-17.md
- E3: https://bugbountylibrary.com/r/c4%3A2024-07-karak%3AM-03.md