Mellow Flexible Vaults — protocol fee multi-accrual in submitReports

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 62109-h-4-protocol-fee-multiple-accrual-in-oraclesubmitreports-she. Standalone Foundry PoC and full write-up: 62109-h-4-protocol-fee-multiple-accrual-in-oraclesubmitreports-she_exp in the evm-hack-registry mirror.

Vulnerability classes: vuln/logic/fee-calculation · wrong-state · fee-accounting

Reproduction: self-contained Foundry PoC with only forge-std. Full trace: output.txt. PoC: test/62109-h-4-protocol-fee-multiple-accrual-in-oraclesubmitreports-she_exp.sol.

AuditVault taxonomy: severity/high · sector/oracle · platform/sherlock · fee-calculation · fee-accounting

Key info#

TL;DR#

1. Each handleReport accrues protocol fees from last timestamp → now.
2. updateState only writes the timestamp when the asset is the base asset.
3. Non-base-first batch re-accrues the same year three times → >300e18 fees vs 100e18 fair.

The vulnerable code#

function updateState(address asset, uint256 priceD18) external {
    if ($.baseAsset[vault] != asset) {
        return; // @> VULN — timestamp not advanced
    }
    $.timestamps[vault] = block.timestamp;
}

Root cause#

Fee accrual is per-report, but the clock only advances on the base asset. Non-base reports leave timestamps[vault] unchanged, so each subsequent report in the same batch recharges the full elapsed interval.

Attack walkthrough#

1. 1000e18 shares, 10% protocol fee, last timestamp = now − 365 days.
2. submitReports([nonBase, nonBase, base]).
3. Fee recipient receives >300e18 shares (finding threshold); fair single accrual is 100e18.

Diagrams#

Impact#

Protocol fees can be charged N times per batch of N assets when non-base assets are ordered first, diluting LPs by minting excess fee shares.

Sources#

• AuditVault finding #62109
• Sherlock issue #167
• Reduced source: FeeManager.sol / Oracle.sol @ eca8836

Sources & further analysis#

Reproductions & code

• Standalone PoC + full trace: 62109-h-4-protocol-fee-multiple-accrual-in-oraclesubmitreports-she_exp (evm-hack-registry mirror).
• AuditVault finding: 62109-h-4-protocol-fee-multiple-accrual-in-oraclesubmitreports-she.

Alerts & third-party analyses

• Web3Sec X hacked database: search.
• Rekt leaderboard: search.
• Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.