# Self-referential fee and beneficiary bugs

Fee or reward paid back to the payer or to the same pool it came from, netting to zero

_Area: DeFi accounting and math bugs. Seen in 13 disclosed reports; latest 2026-03-09. Updated 2026-10-23._

## How it works
A fee, penalty, or reward is supposed to leave the payer and go to a different party. The code routes it to a destination that can be the same entity as the source: the payer's own pool, the same pool key, or the payer themselves. The transfer succeeds and balances look right, but the value never actually moves, so the charge is a no-op. The broken assumption is that source and destination are distinct.

## Where it shows up
- Fee split where the beneficiary key can equal the current pool or collection id [E6](https://bugbountylibrary.com/r/sherlock%3A2024-08-flayer%3AM-11.md).
- Penalty "distributed" to pools the caller is the sole member of [E4](https://bugbountylibrary.com/r/sherlock%3A2025-06-superfluid-locker-system%3AM-1.md).
- Fee redistributed to existing participants, and the payer can cheaply become one first [E5](https://bugbountylibrary.com/r/sherlock%3A2024-11-ethos-network-ii%3AH-4.md).
- Keeper/bot reward paid to whoever executes, and the user can execute atomically via a proxy [E8](https://bugbountylibrary.com/r/c4%3A2022-12-tigris%3AM-17.md).
- Quote and swap parameterized separately (fee tier, slippage), leftover refunded to the contract itself [E1](https://bugbountylibrary.com/r/c4%3A2024-05-bakerfi%3AH-03.md).
- Mint accepts the protocol's own derivative as input [E3](https://bugbountylibrary.com/r/sherlock%3A2022-10-illuminate%3AH-15.md).
- Off-chain reward priced from user-mutable config read at execution [E7](https://bugbountylibrary.com/r/c4%3A2024-03-revert-lend%3AM-23.md).

## How to review
For every fee, penalty, or reward, trace source and destination and ask: can these resolve to the same address, pool, or key? The invariant: value charged to actor A must be credited to an entity that A cannot be or become cheaply in the same transaction. Check that beneficiary ids differ from the paying pool [E6](https://bugbountylibrary.com/r/sherlock%3A2024-08-flayer%3AM-11.md), that the payer is excluded from redistribution [E5](https://bugbountylibrary.com/r/sherlock%3A2024-11-ethos-network-ii%3AH-4.md), that penalty pools cannot be solely the caller [E4](https://bugbountylibrary.com/r/sherlock%3A2025-06-superfluid-locker-system%3AM-1.md), and that quote and execution parameters are the same variable [E1](https://bugbountylibrary.com/r/c4%3A2024-05-bakerfi%3AH-03.md). For permissionless executors, check whether state change and execution can be bundled atomically [E8](https://bugbountylibrary.com/r/c4%3A2022-12-tigris%3AM-17.md).

## Variants seen
- Beneficiary equals current pool, fee stranded for future LPs [E6](https://bugbountylibrary.com/r/sherlock%3A2024-08-flayer%3AM-11.md).
- Sole staker/LP receives own penalty back [E4](https://bugbountylibrary.com/r/sherlock%3A2025-06-superfluid-locker-system%3AM-1.md).
- Split vouch then top up to reclaim own fee [E5](https://bugbountylibrary.com/r/sherlock%3A2024-11-ethos-network-ii%3AH-4.md).
- User as own bot via proxy [E8](https://bugbountylibrary.com/r/c4%3A2022-12-tigris%3AM-17.md).
- Self-transfer of leftover collateral locks funds [E1](https://bugbountylibrary.com/r/c4%3A2024-05-bakerfi%3AH-03.md).
- Own derivative accepted as mint input, inflating supply [E3](https://bugbountylibrary.com/r/sherlock%3A2022-10-illuminate%3AH-15.md).
- Mutable config flips fee at execution [E7](https://bugbountylibrary.com/r/c4%3A2024-03-revert-lend%3AM-23.md).

## Impact and severity
Fees bypassed or stranded, share supply inflated diluting redeemers to zero [E3](https://bugbountylibrary.com/r/sherlock%3A2022-10-illuminate%3AH-15.md), user collateral locked [E1](https://bugbountylibrary.com/r/c4%3A2024-05-bakerfi%3AH-03.md), protocol revenue lost [E7](https://bugbountylibrary.com/r/c4%3A2024-03-revert-lend%3AM-23.md)[E8](https://bugbountylibrary.com/r/c4%3A2022-12-tigris%3AM-17.md). Severity rises when the bypass is repeatable and atomic, and when dilution or locking is permanent.

## Why fixes fail
Partial fixes that exclude one path (e.g. only the initial vouch) leave the top-up path open [E5](https://bugbountylibrary.com/r/sherlock%3A2024-11-ethos-network-ii%3AH-4.md); fixes must block the identity collision, not one call site.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2024-05-bakerfi%3AH-03.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2024-08-flayer%3AM-15.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2022-10-illuminate%3AH-15.md
- E4: https://bugbountylibrary.com/r/sherlock%3A2025-06-superfluid-locker-system%3AM-1.md
- E5: https://bugbountylibrary.com/r/sherlock%3A2024-11-ethos-network-ii%3AH-4.md
- E6: https://bugbountylibrary.com/r/sherlock%3A2024-08-flayer%3AM-11.md
- E7: https://bugbountylibrary.com/r/c4%3A2024-03-revert-lend%3AM-23.md
- E8: https://bugbountylibrary.com/r/c4%3A2022-12-tigris%3AM-17.md