# Fee skipped on alternate path

Value moves but the fee sits on a branch, sentinel, or stale checkpoint that can be bypassed

_Area: DeFi accounting and math bugs. Seen in 7 disclosed reports; latest 2026-06-05. Updated 2026-10-24._

## How it works
A fee is charged on one path but the same value movement is reachable through another path where the deduction is absent, miscomputed, or applied to the wrong base. The broken assumption is that every settlement route passes through the fee logic. When a branch, sentinel address, stale checkpoint, or wrong operand diverts value around it, the fee is silently zero or too small while balances still move.

## Where it shows up
- Transfer hooks that branch on pair reserves/balances to decide fee vs. liquidity-add [E1](https://bugbountylibrary.com/r/dhl%3A20260605-dtxt.md)
- Fee conditionals with multiple branches where only one was patched [E2](https://bugbountylibrary.com/r/cantina%3Asize_february2025%3A3.1.4.md)
- Shares burned at request time but fees accrued on a denominator that excludes them [E3](https://bugbountylibrary.com/r/sherlock%3A2025-07-mellow-flexible-vaults%3AH-6.md)
- Native-asset sentinel addresses passed to ERC20 helpers [E4](https://bugbountylibrary.com/r/sherlock%3A2025-05-dodo-cross-chain-dex%3AM-6.md)
- Fees computed as a delta from a checkpoint that can go stale [E5](https://bugbountylibrary.com/r/cantina%3Ahmx_january2025%3A3.2.5.md)
- AMM swap math missing the `amountIn*fee` term [E6](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AH-10.md)
- Fee gross-up using `out*fee` instead of `out*fee/(1-fee)` [E7](https://bugbountylibrary.com/r/c4%3A2024-06-size%3AH-01.md)

## How to review
Enumerate every path that moves value or shares, then confirm each one applies the fee on the correct base. The invariant: for any settlement, fee_charged equals the documented rate times the grossed-up amount, on every branch. Check that fee-accrual denominators include in-flight shares [E3](https://bugbountylibrary.com/r/sherlock%3A2025-07-mellow-flexible-vaults%3AH-6.md), that sentinel addresses never reach ERC20 calls [E4](https://bugbountylibrary.com/r/sherlock%3A2025-05-dodo-cross-chain-dex%3AM-6.md), that checkpoints cannot skip intermediate rate changes [E5](https://bugbountylibrary.com/r/cantina%3Ahmx_january2025%3A3.2.5.md), and that adjusted-balance math matches canonical Uniswap V2 [E6](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AH-10.md).

## Variants seen
- Reserve-skew branch flips classification, skipping sell fee [E1](https://bugbountylibrary.com/r/dhl%3A20260605-dtxt.md)
- Incomplete fix leaves sibling branch comparing wrong operand [E2](https://bugbountylibrary.com/r/cantina%3Asize_february2025%3A3.1.4.md)
- Queued shares escape fee denominator [E3](https://bugbountylibrary.com/r/sherlock%3A2025-07-mellow-flexible-vaults%3AH-6.md)
- Native sentinel makes ERC20 transfer a no-op success [E4](https://bugbountylibrary.com/r/sherlock%3A2025-05-dodo-cross-chain-dex%3AM-6.md)
- Stale checkpoint collapses fee delta [E5](https://bugbountylibrary.com/r/cantina%3Ahmx_january2025%3A3.2.5.md)
- Missing fee term in swap invariant [E6](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AH-10.md)
- Wrong fee base in gross-up formula [E7](https://bugbountylibrary.com/r/c4%3A2024-06-size%3AH-01.md)

## Why fixes fail
E2 shows a fix patching only the RESERVED_ID branch while the existing-position branch still compared against the wrong position, leaving the bypass open.

## Impact and severity
Led to drained pair liquidity [E1](https://bugbountylibrary.com/r/dhl%3A20260605-dtxt.md), free swaps starving LPs [E6](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AH-10.md), and systematic undercharging [E5](https://bugbountylibrary.com/r/cantina%3Ahmx_january2025%3A3.2.5.md)[E7](https://bugbountylibrary.com/r/c4%3A2024-06-size%3AH-01.md). Severity rises when the bypass is cheap to trigger (1-wei skew [E1](https://bugbountylibrary.com/r/dhl%3A20260605-dtxt.md)) or repeatable (fragmentation [E2](https://bugbountylibrary.com/r/cantina%3Asize_february2025%3A3.1.4.md)).

## Evidence
- E1: https://bugbountylibrary.com/r/dhl%3A20260605-dtxt.md
- E2: https://bugbountylibrary.com/r/cantina%3Asize_february2025%3A3.1.4.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2025-07-mellow-flexible-vaults%3AH-6.md
- E4: https://bugbountylibrary.com/r/sherlock%3A2025-05-dodo-cross-chain-dex%3AM-6.md
- E5: https://bugbountylibrary.com/r/cantina%3Ahmx_january2025%3A3.2.5.md
- E6: https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AH-10.md
- E7: https://bugbountylibrary.com/r/c4%3A2024-06-size%3AH-01.md