# Fee scaling and cap mismatch

Fee parameters whose unit, scale, or bound disagrees with the cap or formula they feed

_Area: DeFi accounting and math bugs. Seen in 14 disclosed reports; latest 2024-09-06. Updated 2026-10-23._

## How it works
A fee parameter is trusted to mean one thing, but the code consumes it as another. The broken assumption: that a configured fee value shares the unit, scale, and range of the check or formula using it. When a percentage is compared to an absolute cap, a divisor has no absolute lower bound, a fixed-point constant adds an extra 1.0, or a user-supplied component is added to a base without a ceiling, the fee math silently yields values the protocol never intended — zero, quadratic, over 100%, or a vacuous invariant.

## Where it shows up
- A fee formula dividing by a configurable `scale` whose lower bound derives from another unconstrained parameter [E1](https://bugbountylibrary.com/r/sherlock%3A2024-08-perennial-v2-update-3%3AH-3.md).
- Forked AMM `swap()` where the fee multiplier and the K-check constant disagree [E2](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-hack-analysis-uranium-finance-april-2021.md).
- Copied scalar constants (e.g. `commitScalar`) not recomputed against real gas cost [E3](https://bugbountylibrary.com/r/sherlock%3A2024-08-morphl2%3AH-3.md).
- Consensus vs execution gas-cost formulas diverging per tx type (legacy vs EIP-1559) [E4](https://bugbountylibrary.com/r/c4%3A2025-09-monad%3AH-01.md).
- A Q32 fraction where the constant is added to `Q32` (1.0), turning a 10% cap into 110% [E5](https://bugbountylibrary.com/r/c4%3A2024-03-revert-lend%3AM-06.md).
- A V2 upgrade adding a fee-override layer, but one entry point still reads the old default [E6](https://bugbountylibrary.com/r/cantina%3Ajigsaw_june2025%3A3.2.2.md).
- Multiple coin types where one branch clamps a sender-supplied limit and another does not [E7](https://bugbountylibrary.com/r/c4%3A2023-11-zetachain%3AM-16.md).
- Fee computed as `base + user_supplied` over a fixed denominator, with no check the sum stays below it [E8](https://bugbountylibrary.com/r/sherlock%3A2024-06-boost-aa-wallet%3AM-2.md).

## How to review
For every fee parameter, state its unit and intended range, then grep every comparison and multiplication site and diff the units. The invariant: the fee actually charged stays within the documented cap and scale for all values the parameter can legally take. Verify lower bounds are absolute, not derived from other unconstrained inputs; verify user-supplied components cannot reach the denominator; verify forked constants are mirrored in every check; verify each asset/tx-type branch applies the same clamp; verify new fee layers are consulted at every charging entry point.

## Variants seen
- Unbounded divisor making fees quadratic [E1](https://bugbountylibrary.com/r/sherlock%3A2024-08-perennial-v2-update-3%3AH-3.md).
- Fork constant mismatch making the K-check vacuous [E2](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-hack-analysis-uranium-finance-april-2021.md).
- Misconfigured scalar underpricing cost [E3](https://bugbountylibrary.com/r/sherlock%3A2024-08-morphl2%3AH-3.md).
- Per-tx-type formula divergence [E4](https://bugbountylibrary.com/r/c4%3A2025-09-monad%3AH-01.md).
- Fixed-point constant inflating a cap [E5](https://bugbountylibrary.com/r/c4%3A2024-03-revert-lend%3AM-06.md).
- Stale default fee bypassing the override layer [E6](https://bugbountylibrary.com/r/cantina%3Ajigsaw_june2025%3A3.2.2.md).
- Missing clamp in one coin-type branch [E7](https://bugbountylibrary.com/r/c4%3A2023-11-zetachain%3AM-16.md).
- Unbounded additive component reaching 100% [E8](https://bugbountylibrary.com/r/sherlock%3A2024-06-boost-aa-wallet%3AM-2.md).

## Impact and severity
High to critical where the fee feeds settlement: full market collateral drain [E1](https://bugbountylibrary.com/r/sherlock%3A2024-08-perennial-v2-update-3%3AH-3.md), ~$50m pool drain [E2](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-hack-analysis-uranium-finance-april-2021.md). Medium where it shifts cost or revenue: underpaid L1 fees [E3](https://bugbountylibrary.com/r/sherlock%3A2024-08-morphl2%3AH-3.md), block-invalidating gas divergence [E4](https://bugbountylibrary.com/r/c4%3A2025-09-monad%3AH-01.md), inflated borrow caps [E5](https://bugbountylibrary.com/r/c4%3A2024-03-revert-lend%3AM-06.md), mischarged rewards [E6](https://bugbountylibrary.com/r/cantina%3Ajigsaw_june2025%3A3.2.2.md), underpaid gas [E7](https://bugbountylibrary.com/r/c4%3A2023-11-zetachain%3AM-16.md), protocol revenue starvation [E8](https://bugbountylibrary.com/r/sherlock%3A2024-06-boost-aa-wallet%3AM-2.md). Worse when a privileged role controls the parameter or the fee feeds a global accumulator.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2024-08-perennial-v2-update-3%3AH-3.md
- E2: https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-hack-analysis-uranium-finance-april-2021.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2024-08-morphl2%3AH-3.md
- E4: https://bugbountylibrary.com/r/c4%3A2025-09-monad%3AH-01.md
- E5: https://bugbountylibrary.com/r/c4%3A2024-03-revert-lend%3AM-06.md
- E6: https://bugbountylibrary.com/r/cantina%3Ajigsaw_june2025%3A3.2.2.md
- E7: https://bugbountylibrary.com/r/c4%3A2023-11-zetachain%3AM-16.md
- E8: https://bugbountylibrary.com/r/sherlock%3A2024-06-boost-aa-wallet%3AM-2.md