# Execution-time fee and rate reads

Fees, rates or terms read from mutable storage at execution instead of signed or snapshotted values

_Area: DeFi accounting and math bugs. Seen in 4 disclosed reports; latest 2026-01-05. Updated 2026-10-23._

## How it works
A contract computes an amount (payment, fee, rate, terms) by reading a value from mutable storage at the moment it executes, rather than from a value the affected party committed to or that was fixed when the obligation was created. Whoever can mutate that storage — an owner, a manager, a market registry — can change the number between the user's decision and the transaction's execution, or apply a new number retroactively to amounts already earned. The broken assumption is that the value read at execution equals the value the counterparty relied on.

## Where it shows up
- Payment or fee derived from a record the payer controls (e.g. a recipient's bid) rather than the seller's ask [E1](https://bugbountylibrary.com/r/c4%3A2024-10-coded-estate%3AH-03.md)
- Fee/rate parameters applied lazily at collection to accrued-but-unclaimed amounts [E3](https://bugbountylibrary.com/r/sherlock%3A2023-06-arrakis%3AM-5.md)
- Config read from an owner-mutable registry inside a submit/accept function [E4](https://bugbountylibrary.com/r/sherlock%3A2023-03-teller%3AM-7.md)[E5](https://bugbountylibrary.com/r/sherlock%3A2023-03-teller%3AM-15.md)
- Fee setters with no timelock, callable in the same block as the consuming call [E5](https://bugbountylibrary.com/r/sherlock%3A2023-03-teller%3AM-15.md)
- Decay clocks (last-update timestamps) advanced on paths that skip the decay math [E2](https://bugbountylibrary.com/r/c4%3A2022-10-traderjoe%3AM-05.md)

## How to review
For each amount computed at execution, ask: who can change the inputs, and did the party bearing the cost sign or snapshot them? The invariant: any value that determines what a user pays or receives must be fixed at the time that user commits (signed input, checkpoint, or snapshot), or be immutable for the duration of the obligation. Check that fee/rate changes cannot apply to already-accrued unclaimed amounts [E3](https://bugbountylibrary.com/r/sherlock%3A2023-06-arrakis%3AM-5.md), that setters cannot act in the same block as the consuming call [E5](https://bugbountylibrary.com/r/sherlock%3A2023-03-teller%3AM-15.md), and that timestamps only advance when the corresponding computation actually runs [E2](https://bugbountylibrary.com/r/c4%3A2022-10-traderjoe%3AM-05.md). For marketplace finalization, confirm payment is validated against the seller's listed price, not a buyer-supplied record [E1](https://bugbountylibrary.com/r/c4%3A2024-10-coded-estate%3AH-03.md).

## Variants seen
- Payment sourced from recipient's bid record, zero-bid recipient transfers free [E1](https://bugbountylibrary.com/r/c4%3A2024-10-coded-estate%3AH-03.md)
- Decay timestamp reset by dust swaps pins fees at max [E2](https://bugbountylibrary.com/r/c4%3A2022-10-traderjoe%3AM-05.md)
- Fee rate raised before collection, applied retroactively to pending fees [E3](https://bugbountylibrary.com/r/sherlock%3A2023-06-arrakis%3AM-5.md)
- Registry terms (cycle, duration, type) read at bid submission, changed mid-mempool [E4](https://bugbountylibrary.com/r/sherlock%3A2023-03-teller%3AM-7.md)
- Marketplace fee raised to 100% front-running lender acceptance [E5](https://bugbountylibrary.com/r/sherlock%3A2023-03-teller%3AM-15.md)

## Impact and severity
Loss of principal or assets (free NFT transfer [E1](https://bugbountylibrary.com/r/c4%3A2024-10-coded-estate%3AH-03.md), lender funds siphoned [E5](https://bugbountylibrary.com/r/sherlock%3A2023-03-teller%3AM-15.md)), retroactive confiscation of earned fees [E3](https://bugbountylibrary.com/r/sherlock%3A2023-06-arrakis%3AM-5.md), forced default and liquidation [E4](https://bugbountylibrary.com/r/sherlock%3A2023-03-teller%3AM-7.md), and fees pinned at maximum [E2](https://bugbountylibrary.com/r/c4%3A2022-10-traderjoe%3AM-05.md). Severity rises when the mutating party is privileged and unconstrained by timelock, and when the read happens after the victim's commitment.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2024-10-coded-estate%3AH-03.md
- E2: https://bugbountylibrary.com/r/c4%3A2022-10-traderjoe%3AM-05.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2023-06-arrakis%3AM-5.md
- E4: https://bugbountylibrary.com/r/sherlock%3A2023-03-teller%3AM-7.md
- E5: https://bugbountylibrary.com/r/sherlock%3A2023-03-teller%3AM-15.md