# Silo Finance Logic Error Bugfix Review

Donating WETH to a zero-deposit Silo market inflated utilization past 100%, spiking interest so a tiny deposit borrowed most of the pool.

- Payout: $100,000
- Severity: critical
- Program: Silo Finance
- Credited: kankodu
- Disclosed: 2023-06-16
- Write-up quality: 8/10
- Original: https://immunefi.com/blog/bug-fix-reviews/silo-finance-logic-error/
- Library page: https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-silo-finance-logic-error
- Tags: domain:web3 impact:funds-loss kind:bounty platform:blog platform:immunefi sev:critical tech:evm tech:solidity technique:chained technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** Base Silo lending contract (deposit/borrow/accrueInterest)
**Root cause:** liquidity() uses token balance minus collateralOnlyDeposits, so donated tokens create a gap between totalDeposits and actual balance; borrowing the donated amount pushes utilization above 100%, and accrueInterest then compounds an enormous interest rate onto the attacker's tiny deposit.
**Steps:**
1. Find a Silo market where an asset (WETH) has totalDeposits == 0.
2. `SILO.deposit(WETH, 1e5 wei, false)` to become majority shareholder and set totalDeposits nonzero.
3. `WETH.transfer(address(SILO), 1e18)` to donate 1 WETH, creating a balance/deposit gap.
4. From a second account, deposit LINK collateral (`SILO.deposit(LINK, 545e18, true)`) and `SILO.borrow(WETH, 1 ether)`, draining the donated WETH.
5. Next block, call `SILO.accrueInterest(WETH)`: totalBorrows >> totalDeposits inflates utilization >100% and compounds interest to >5000 ETH.
6. Attacker's 1e5 wei deposit is now worth >5000 ETH; `SILO.borrow(XAI, XAI.balanceOf(SILO))` drains ~450K XAI.
**How found:** Whitehat noticed markets with zero totalDeposits where liquidity() (balance minus collateralOnlyDeposits) diverges from recorded totalDeposits, hypothesizing that donations plus a borrow could push utilization above 100% and compound runaway interest.
**Exploitation:** Two-block attack: block 1 seeds a tiny deposit, donates WETH, and borrows it via a second account to create borrow>deposit; block 2 accrues interest to inflate the attacker's collateral value, then borrows the entire XAI liquidity of the market. No flash loan possible due to cross-block timing; Forge deal() simulated capital.
**Escalation:** Interest inflation turns a 1e5 wei deposit into >5000 ETH collateral, enabling draining all XAI in the pool (~$3M estimated across pools).
**Insight:** In lending protocols, check whether liquidity/balance accounting can diverge from recorded deposits via direct token transfers; any market with zero deposits is a candidate for utilization>100% interest-rate manipulation across blocks.