# Just-in-time fee capture by flash-loan LPs

Fees settled lazily and split by current share, letting a same-block LP deposit capture accrued fees

_Area: DeFi oracles, liquidations and flash loans. Seen in 4 disclosed reports; latest 2024-10-31. Updated 2026-10-23._

## How it works
Fees or yield accrue to a pool but are only credited to LPs at a later state-changing event (a position close, a loan, an unstake). At that moment the payout is split pro-rata by *current* pool share, not by how long or how much each LP was actually exposed. Anyone who can add liquidity just before the settlement and remove it just after captures a share of fees they never earned. Flash loans make the required capital free for one block, so the attack is cheap and repeatable. The broken assumption is that "current share" reflects "who bore the risk while the fee accrued."

## Where to show up
- Fees/yield credited to share price or per-share accumulators at a discrete event, not continuously.
- Payout split by instantaneous pool share or by a narrow slice (active bin/tick) while the fee was generated across all liquidity.
- Liquidity add/remove allowed in the same block with no lockup, withdrawal fee, or minimum dwell time.
- Borrowing/loan fees that only settle when a position closes [E1](https://bugbountylibrary.com/r/sherlock%3A2024-08-velar-artha%3AH-2.md).
- Loan primitives that lend the whole balance but pay fees only to active-bin LPs [E2](https://bugbountylibrary.com/r/c4%3A2022-10-traderjoe%3AM-03.md).
- Instant-unstake fees distributed immediately to current LPs [E3](https://bugbountylibrary.com/r/c4%3A2022-06-yieldy%3AH-04.md).

## How to review
The invariant: an LP's claim on a fee must be proportional to the liquidity they provided *while that fee accrued*, and must not be obtainable by capital present only at settlement. Check:
- Is fee accounting continuous (accrued per block/second to shares) or lumped at an event?
- Can share price jump at a single transaction that an outsider can front-run?
- Is there any lockup, withdrawal fee, or time-weighting that makes JIT entry unprofitable?
- Does the fee payer's own liquidity let them reclaim the fee they just paid [E1](https://bugbountylibrary.com/r/sherlock%3A2024-08-velar-artha%3AH-2.md)?

## Variants seen
- Self-sandwich: borrower flash-loans LP liquidity, closes position, reclaims most borrowing fees as an LP [E1](https://bugbountylibrary.com/r/sherlock%3A2024-08-velar-artha%3AH-2.md).
- Active-slice capture: tiny active-bin position captures fees on a loan drawn from the whole pair [E2](https://bugbountylibrary.com/r/c4%3A2022-10-traderjoe%3AM-03.md).
- JIT around large unstake: add before, remove after, skim instant-unstake fee yield [E3](https://bugbountylibrary.com/r/c4%3A2022-06-yieldy%3AH-04.md).

## Impact and severity
Fee/yield theft from honest LPs; in E1 the user recovers essentially all their own fees, in E2/E3 outsiders steal yield. Severity is high where amounts are large and the attack is same-block and capital-free via flash loans. Worse when there is no lockup and settlement is predictable (a pending large unstake or close).

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2024-08-velar-artha%3AH-2.md
- E2: https://bugbountylibrary.com/r/c4%3A2022-10-traderjoe%3AM-03.md
- E3: https://bugbountylibrary.com/r/c4%3A2022-06-yieldy%3AH-04.md