# Caller-supplied amount skips fee

Fee or principal taken from a user-supplied amount rather than the measured transfer or balance delta

_Area: DeFi accounting and math bugs. Seen in 3 disclosed reports; latest 2025-08-21. Updated 2026-10-23._

## How it works
Accounting code assumes a number the caller passes in equals what actually moved. When the fee, principal, or branch decision is computed from that supplied value (or from a balance the caller controls) instead of the measured delta of the contract's own balances, the two can diverge. The caller picks a value that makes the fee zero or negative while the real value still settles, so the books record a repayment or swap that never paid its share.

## Where it shows up
- Fee or transfer amount read from a function argument, not from before/after balance of the recipient [E1](https://bugbountylibrary.com/r/cantina%3Acircuit_puzzles%3A3.2.1.md).
- Debt or principal variables with no non-negative bound, so a full repayment can drive them below zero [E1](https://bugbountylibrary.com/r/cantina%3Acircuit_puzzles%3A3.2.1.md).
- `transferFrom` overrides that move funds (fees, rebasing) before the allowance check in `super` [E2](https://bugbountylibrary.com/r/c4%3A2025-01-next-generation%3AM-01.md).
- Fee/refund branches gated on `balanceOf` of a caller-supplied token address [E3](https://bugbountylibrary.com/r/c4%3A2021-10-tally%3AM-03.md).
- Any `if (amount > 0)` fee guard where `amount` is user input.

## How to review
Identify every value that decides a fee, refund, or debt update. For each, ask: is it the caller's argument, or a measured delta (`balanceAfter - balanceBefore`) of a contract-owned account? The invariant: the fee actually collected must equal the fee the accounting records, and no accounting variable may leave its valid range (principal >= 0, allowance >= amount + fee). Check that allowance is validated against the total debited, including any hook fee [E2](https://bugbountylibrary.com/r/c4%3A2025-01-next-generation%3AM-01.md). Check that branch conditions use trusted addresses, not caller-supplied ones [E3](https://bugbountylibrary.com/r/c4%3A2021-10-tally%3AM-03.md).

## Variants seen
- User-supplied fee amount plus unbounded principal lets fees be burned while debt settles [E1](https://bugbountylibrary.com/r/cantina%3Acircuit_puzzles%3A3.2.1.md).
- Fee deducted from sender outside allowance accounting, draining more than approved [E2](https://bugbountylibrary.com/r/c4%3A2025-01-next-generation%3AM-01.md).
- Attacker-controlled token `balanceOf` flips a fee-exempt refund branch [E3](https://bugbountylibrary.com/r/c4%3A2021-10-tally%3AM-03.md).

## Impact and severity
Lost protocol revenue (fees never reach treasury) and allowance over-spend beyond user consent [E1](https://bugbountylibrary.com/r/cantina%3Acircuit_puzzles%3A3.2.1.md)[E2](https://bugbountylibrary.com/r/c4%3A2025-01-next-generation%3AM-01.md). Severity rises when the same flaw lets value be reclassified as fee-free refund [E3](https://bugbountylibrary.com/r/c4%3A2021-10-tally%3AM-03.md) or when debt accounting goes negative, corrupting solvency state [E1](https://bugbountylibrary.com/r/cantina%3Acircuit_puzzles%3A3.2.1.md). Repeatable per transaction, so losses compound.

## Evidence
- E1: https://bugbountylibrary.com/r/cantina%3Acircuit_puzzles%3A3.2.1.md
- E2: https://bugbountylibrary.com/r/c4%3A2025-01-next-generation%3AM-01.md
- E3: https://bugbountylibrary.com/r/c4%3A2021-10-tally%3AM-03.md