# Fee bypass via full-balance spend

Function meters msg.value or a supplied amount but spends the whole token balance, skipping the fee

_Area: DeFi accounting and math bugs. Seen in 3 disclosed reports; latest 2025-06-02. Updated 2026-10-29._

## How it works
A routine charges a fee, royalty, or pump on one quantity (msg.value, a user-supplied limit, or a capped repay) but then acts on a different, larger quantity (the contract's whole token balance, the actual bid, or the full position). The metered amount and the spent amount diverge, so the fee is computed on the small number while value moves on the big one. The broken assumption is that the amount charged equals the amount used.

## Where it shows up
- A function reads `msg.value` or a parameter for fee math, then references `token.balanceOf(address(this))` or a stored total for the actual operation.
- A slippage/limit parameter (e.g. `min_amount`) is forwarded as the price argument into a downstream fee/royalty CPI.
- A repay/unhold amount is capped with `min()` against the outstanding borrow, while a separate debt-tracking field is cleared.
- Contracts that can be pre-funded by transferring tokens before the call.

## How to review
Identify every quantity the function touches: the amount fee is charged on, the amount actually moved, and the amount recorded in state. The invariant: the base used for fee/royalty/pump math must equal the value actually spent or transferred, and any cap must not zero a tracking field without reducing the underlying position. Check whether a caller can pre-fund the contract or set a limit to an extreme (0) to decouple these. Confirm the fee base is derived from the real transferred amount, not a user-controlled or partial figure.

## Variants seen
- Pre-funding the contract so a pump charged on `msg.value` is skipped while the full WETH balance is deployed [E3](https://bugbountylibrary.com/r/sherlock%3A2025-06-superfluid-locker-system%3AH-2.md).
- Reusing a user-supplied slippage limit as the royalty price in a CPI, so a zero limit zeroes the fee [E2](https://bugbountylibrary.com/r/cantina%3Atensor_nov2024%3A3.1.5.md).
- Capping an unhold at the borrowed amount so excess margin clears `holdAmount` to zero while the leveraged position stays open, dodging borrowing fees [E1](https://bugbountylibrary.com/r/sherlock%3A2024-05-elfi-protocol%3AH-23.md).

## Impact and severity
Fees, royalties, or buy-pressure are underpaid or eliminated while the full position or value is retained. Severity is high where it lets a user keep a leveraged position or marketplace trade without the intended cost; worse when the bypass is repeatable and the fee base is fully attacker-controlled.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2024-05-elfi-protocol%3AH-23.md
- E2: https://bugbountylibrary.com/r/cantina%3Atensor_nov2024%3A3.1.5.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2025-06-superfluid-locker-system%3AH-2.md