# Equality check should be performed for fees, not >= as it can lead to users sending more fees than supposed Crit/High · Three Sigma · Cross-chain bridge · 15th July, 2024 Finding 3S-OB-M03 of the Orange Bridge security review. - Protocol: https://www.orangeweb3.com/ - Report: /reports/orange - Source: https://cdn.sanity.io/files/qoqld077/production/686ad4e1d5035d69002f5f97e281e3c5a8b7ce00.pdf --- ### Description In BRC20Factory::burn(), Vault::deposit(), it is required that the fee is equal to or exceeds the msg.value. However, this could lead to loss of fees, as the fee can be lowered without users noticing (or frontrunning them), and users would lose this part of the fee. In the case of the Vault, these funds would be left untracked because the fees are tracked in totalFees, so the owner would not be able to withdraw these extra funds. ### Recommendation Replace the >= checks for ==. The equality check should be performed for fees, not >= as it can lead to users sending more fees than supposed ### Status Addressed in [#2f47c6c](https://github.com/orangecryptohq/orange-bridge-contract/commit/2f47c6cd85cb445b70f5e57fba6d8b955d082d0a). --- Related findings: - [The domain with 0 index in Cap::_checkRemoteStateAndAdvance() is not checked for equality](https://0xsimao.com/findings/mitosis-index-remote-advance-equality): Mitosis - [Users can exploit the batch minting feature to avoid paying minting fees for tokens](https://0xsimao.com/findings/titles-publishing-protocol-exploit-feature-avoid-fees): TITLES Publishing Protocol - [Malicious users could lock in the NAV/Share of the DV to cause the loss of fees](https://0xsimao.com/findings/tokemak-lock-nav-share-fees): Tokemak - [Consider adding a check to ensure that fees, delegate cover and so on have been explicitly set.](https://0xsimao.com/findings/maple-finance-iii-ensure-fees-delegate-explicitly): Maple Finance