# If xShadow is token0 or token1, ShadowStrategyGauge::collectGaugeRewards() will take protocol fee on user funds Low/Info · 0xSimao · Leveraged yield farming · 12th May 2025 Finding I-2 of the Yieldoor Gauges security review. - Protocol: https://app.yieldoor.com/ - Report: /reports/yieldoor-i - Source: https://github.com/0xSimao/audits/blob/main/0xSimao/2025-05-12-yieldoor-i.pdf --- **Description:** Although at the moment there isn't an `xShadow` pool, so it's impossible for it to be token0 or token1, `ShadowStrategyGauge::collectGaugeRewards()` would exit `xShadow` to `shadow`, and then convert it back to `xShadow`, taking a protocol fee in the process. **Recommended Mitigation:** Add a comment or similar. --- Related findings: - [Aave RewardsController can add Usdc to the rewards list and the strategy has no way to collect the rewards](https://0xsimao.com/findings/maple-finance-iv-aave-rewards-usdc-way): Maple Cash Strategies - [Malicious user may frontrun `GoodDollarExpansionController::mintUBIFromReserveBalance()` to make protocol funds stuck](https://0xsimao.com/findings/mento-frontrun-mint-ubi-stuck): Mento - [Anyone will DoS setting a new rewards duration which harms the protocol/users as they will receive too much or too little rewards](https://0xsimao.com/findings/exactly-protocol-update-staking-contract-ii-rewards-duration-harms-little): Exactly Protocol Update - Staking Contract - [Protocol fee from Market.sol is locked](https://0xsimao.com/findings/perennial-v2-fee-market-sol-locked): Perennial V2