# Fees or vested position withdrawal in ShadowStrategyGauge::addVestingPosition() when collecting fees will be revested Medium · 0xSimao · Leveraged yield farming · 12th May 2025 Finding M-1 of the Yieldoor Gauges security review. - Protocol: https://app.yieldoor.com/ - Report: /reports/yieldoor-i - Source: https://github.com/0xSimao/audits/blob/main/0xSimao/2025-05-12-yieldoor-i.pdf --- **Description:** `ShadowStrategyGauge::_addVestingPosition()` collects fees first, coming either from LP fees or withdrawing from the vested position. Any leftover balance exceeding the [initial balance](https://github.com/spacegliderrrr/yieldoor/blob/master/src/instances/ShadowStrategyGauge.sol#L492) [after](https://github.com/spacegliderrrr/yieldoor/blob/master/src/instances/ShadowStrategyGauge.sol#L547) this call in `ShadowStrategyGauge::collectGaugeRewards()` is considered vested position, but this may result from already unvested amounts or claimed fees, which will be vested again. **Recommended Mitigation:** Collect fees at the beginning of the ShadowStrategyGauge::collectGaugeRewards() call, before the balance snapshot is taken. --- Related findings: - [Uniswap collect fees should skip collecting fees of one of the tokens if the amount is 0](https://0xsimao.com/findings/singularity-uniswap-fees-skip-collecting): Singularity - [Aave RewardsController can add Usdc to the rewards list and the strategy has no way to collect the rewards](https://0xsimao.com/findings/maple-finance-iv-aave-rewards-usdc-way): Maple Cash Strategies - [`ManagedLeveragedVault::executeWithdrawalEpoch()` incorrect ICR and DoSed withdrawals due to not accouting for fees](https://0xsimao.com/findings/beraborrow-i-withdrawal-epoch-withdrawals-fees): Beraborrow Managed Dens - [ERC4626YieldBackend does not support vaults with deposit/withdrawal fees or slashing](https://0xsimao.com/findings/superfluid-erc4626-yield-withdrawal-slashing): Superfluid Yield Backends