# Attacker can swap wBTC in the DeliHook multiples times to not pay / pay less swap fees Medium · Sherlock · Perpetuals DEX · 2nd September 2025 Finding M-6 of the BMX competition. - Protocol: https://audits.sherlock.xyz/contests/1154 - Source: https://github.com/sherlock-audit/2025-09-bmx-deli-swap-judging/issues/203 --- ### Summary `DeliHook::_beforeSwap()` rounds down the `baseFeeSpecified` instead of rounding up, allowing an attacker to abuse the low gas fees on Base and the high btc price to not pay any fees (or half). The attacker swaps in a pool with the DeliHook and wBTC, with a fee of for example 300 (0.03%). For a wBTC amount of 3000 wei or 3 USD, `baseFeeSpecified = 3000 * 300 / 1e6 = 0.9 = 0`, and the user pays 0. If a 0 fee is problematic for any reason, the attacker can specify 6000 wei, and still save 1 wBTC due to rounding down each time. The attack is economic viable because 1 wei of wBTC = 1 * 100_000 / 1e8 = 0.001 USD, and the gas cost of a single swap, when bundled together to optimize hot storage, is many times smaller. As an example, a [sample swap](https://basescan.org/tx/0x46371f3cfdcc401d7f01e2fed089110d10af9a37093b9f1c5e3fb73442df804f) takes a fee of 0.001566 USD, without using the hot storage properties nor fixed costs, and is already close to profitability. If swaps are made in a loop, the gas price of each swap will go down a lot due to not having fixed tx costs and hot storage loading, making the attack viable. In times of lower gas usage, it is even more profitable. This causes a 100% fee loss for users of the protocol, hence high severity. Note: it should also round up when converting the baseFeeSpecified to the fee currency, when needed. ### Root Cause [DeliHook.sol:231](https://github.com/sherlock-audit/2025-09-bmx-deli-swap/blob/main/deli-swap-contracts/src/DeliHook.sol#L231) rounds down instead of up. ### Internal Pre-conditions None ### External Pre-conditions None ### Attack Path 1. Attacker swaps in a loop wBTC, paying 1 less wBTC each time due to rounding down, so the lps (FeeProcessor, DailyEpochGauge) receive much less fees. ### Impact A single attacker can cause a significant loss, if all users do this, they would eliminate all lp fees, or very significantly reduce them, and it is profitable. ### PoC See above. ### Mitigation Round up the fee. --- Related findings: - [When APR late rate is lower than APR, an OCC locker bullet loan borrower can pay way less interests by calling the loan](https://0xsimao.com/findings/zivoe-occ-bullet-pay-interests): Zivoe - [`Claimers` can receive less `feePerClaim` than they should if some prizes are already claimed or if reverts because of a reverting hook](https://0xsimao.com/findings/pooltogether-the-prize-layer-for-defi-claimers-fee-reverts-hook): PoolTogether Prize Layer