# Users always pay fee on the full swapped amount in the `DeliHook`, even if the swap is smaller Medium · Sherlock · Perpetuals DEX · 2nd September 2025 Finding M-4 of the BMX competition. - Protocol: https://audits.sherlock.xyz/contests/1154 - Source: https://github.com/sherlock-audit/2025-09-bmx-deli-swap-judging/issues/154 --- ### Summary Users can specify a price limit in their swap, limiting the amount of funds actually swapped, or there may not be enough assets of one of the tokens to swap. The `DeliHook` doesn't take this into account, always paying fee over the full amount specified, overcharging the user by a very significant amount, [link](https://github.com/sherlock-audit/2025-09-bmx-deli-swap/blob/main/deli-swap-contracts/src/DeliHook.sol#L231). ### Root Cause In `DeliHook.sol:231`, the fee is always calculated on the full input amount, regardless of the actual amount swappd. ### Internal Pre-conditions None. ### External Pre-conditions None. ### Attack Path 1. User does a swap, specifying a sqrt limit price that will be [hit](https://github.com/Uniswap/v4-core/blob/main/src/libraries/Pool.sol#L344) without using the full input/output amount. Or, alternatively, the pool runs out of one of the tokens. 2. `DeliHook` will apply the fee on the full input amount, instead of just the amount swapped, [link](https://github.com/Uniswap/v4-core/blob/main/src/libraries/Hooks.sol#L311-L312) to where the fee is applied. ### Impact If the user specifies a sqrtPrice limit that only swaps 50% of the input/output funds, and the fee is calculated on 100% of the amount, it would be an error of 100%, high severity, and scales with the amount swapped. ### PoC None ### Mitigation Adjust the fee for the actual amount swapped. --- Related findings: - [`Claimers` can receive less `feePerClaim` than they should if some prizes are already claimed or if reverts because of a reverting hook](https://0xsimao.com/findings/pooltogether-the-prize-layer-for-defi-claimers-fee-reverts-hook): PoolTogether Prize Layer - [In AggregateHook, several if (newAmount == 0) checks are ambiguous](https://0xsimao.com/findings/mitosis-aggregate-hook-several-ambiguous): Mitosis - [mTapiocaOFT can't be rebalanced because the Balancer in tapiocaz-audit calls swapETH() or swap() of the RouterETH but does not forward ether for the message fee](https://0xsimao.com/findings/tapioca-dao-rebalanced-balancer-eth-fee): Tapioca DAO - [DarkPoolAssetManager can be drained by looping over join(), joinSplit() or swap() with only some initial amount](https://0xsimao.com/findings/singularity-dark-looping-join-split): Singularity