# Zero or dust fee basis bypass

Fee computed from a zeroable or caller-controlled basis, or skipped by an early return, while value still settles

_Area: DeFi accounting and math bugs. Seen in 28 disclosed reports; latest 2026-03-09. Updated 2026-10-23._

## How it works
A fee is computed from an amount, a rate, or a `min()` of components, and the code assumes that basis is meaningful. When the basis is zero, dust, or caller-supplied, the fee truncates to zero, or an early return skips the whole fee block. The value or debt still settles, so the fee is never collected. The broken assumption: every path that moves value or settles debt passes a nonzero, validated basis into fee accounting. The invariant: for any path that moves value or settles debt, the fee basis is not silently zeroed, and the fee is deducted from the same accounting the transfer uses.

## Where it shows up
- Fee = `min(a, b)` where a caller can zero one component [E1](https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AH-03.md)
- Early-return guards like `if (premium == 0) return` that skip fee logic on real flows [E1](https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AH-03.md)
- Fee derived from a maker-supplied order field (`totalAmt`) never checked against the amount actually transferred [E2](https://bugbountylibrary.com/r/c4%3A2022-07-golom%3AH-08.md)
- Fee/gas term multiplied by a congestion multiplier with a zero floor, nullifying size fees [E3](https://bugbountylibrary.com/r/blog%3Amudit-blog-free-blockchain-storage-bug-substrate.md)
- Fee gated on a computed remainder that a counterpart-position branch zeroes by construction [E4](https://bugbountylibrary.com/r/c4%3A2024-06-size%3AM-13.md)
- Fee/flow rate derived from a staker count with no zero-staker check; zero rate does not revert [E5](https://bugbountylibrary.com/r/sherlock%3A2024-11-superfluid-locking-contract%3AM-3.md)
- Early return on `feePercent == 0` that also skips unrelated accumulator bookkeeping [E6](https://bugbountylibrary.com/r/cantina%3Asuperform_may2025%3A3.2.2.md)
- Alternate settlement path (force-repay via liquidate) omitting the fee the primary path deducts [E7](https://bugbountylibrary.com/r/cantina%3Aalchemix_may2025%3A3.2.2.md)
- Integer division ordering that truncates the fee basis to zero before a clamp applies [E8](https://bugbountylibrary.com/r/sherlock%3A2024-08-velar-artha%3AM-2.md)

## How to review
For every fee computation, trace each caller and confirm the basis is nonzero and independently validated against the value actually transferred. For each `min()` component, list every caller and check whether any argument can be zeroed by caller input; state the invariant explicitly: fee basis > 0 whenever value moves, and fee deducted from the same accounting the transfer uses. Diff parallel settlement paths (repay vs force-repay, swap vs withdraw) for identical fee side effects. Check that early returns do not bypass fee accounting on legitimate flows, that every multiplier in a fee formula has a nonzero floor, and that division ordering does not truncate the basis before a clamp. To judge exploitability, ask whether the bypass is repeatable and permissionless and whether it moves value outside the intended accounting.

## Variants seen
- `min()` fee zeroed by zero arguments plus premium guard [E1](https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AH-03.md)
- Maker-supplied order total zeroed, real payment hidden [E2](https://bugbountylibrary.com/r/c4%3A2022-07-golom%3AH-08.md)
- Congestion multiplier with zero floor nullifies size/weight fees [E3](https://bugbountylibrary.com/r/blog%3Amudit-blog-free-blockchain-storage-bug-substrate.md)
- Counterpart position sized to zero the fee-gating remainder [E4](https://bugbountylibrary.com/r/c4%3A2024-06-size%3AM-13.md)
- Zero-staker rate silently disables tax, loopable [E5](https://bugbountylibrary.com/r/sherlock%3A2024-11-superfluid-locking-contract%3AM-3.md)
- Zero-fee early return skips accumulator decrements, corrupting later fee accounting [E6](https://bugbountylibrary.com/r/cantina%3Asuperform_may2025%3A3.2.2.md)
- Force-repay path skips protocolFee that repay charges [E7](https://bugbountylibrary.com/r/cantina%3Aalchemix_may2025%3A3.2.2.md)
- Division ordering truncates funding fee to zero [E8](https://bugbountylibrary.com/r/sherlock%3A2024-08-velar-artha%3AM-2.md)

## Why fixes fail
A fee-bypass fix that only patches one branch of the conditional leaves the sibling branch comparing the wrong operand, so the bypass survives [E1](https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AH-03.md).

## Impact and severity
Fees silently uncollected, LPs and treasuries starved [E1](https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AH-03.md)[E2](https://bugbountylibrary.com/r/c4%3A2022-07-golom%3AH-08.md)[E3](https://bugbountylibrary.com/r/blog%3Amudit-blog-free-blockchain-storage-bug-substrate.md)[E4](https://bugbountylibrary.com/r/c4%3A2024-06-size%3AM-13.md)[E7](https://bugbountylibrary.com/r/cantina%3Aalchemix_may2025%3A3.2.2.md)[E8](https://bugbountylibrary.com/r/sherlock%3A2024-08-velar-artha%3AM-2.md). Severity rises when the bypass is repeatable and permissionless: E5's loopable zero-tax unlock is the driver, and E3 gives free transactions. [E6](https://bugbountylibrary.com/r/cantina%3Asuperform_may2025%3A3.2.2.md) corrupts later accounting rather than losing a single fee.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AH-03.md
- E2: https://bugbountylibrary.com/r/c4%3A2022-07-golom%3AH-08.md
- E3: https://bugbountylibrary.com/r/blog%3Amudit-blog-free-blockchain-storage-bug-substrate.md
- E4: https://bugbountylibrary.com/r/c4%3A2024-06-size%3AM-13.md
- E5: https://bugbountylibrary.com/r/sherlock%3A2024-11-superfluid-locking-contract%3AM-3.md
- E6: https://bugbountylibrary.com/r/cantina%3Asuperform_may2025%3A3.2.2.md
- E7: https://bugbountylibrary.com/r/cantina%3Aalchemix_may2025%3A3.2.2.md
- E8: https://bugbountylibrary.com/r/sherlock%3A2024-08-velar-artha%3AM-2.md