# Users can avoid paying borrowing interest after the fyToken matures

After fyToken maturity, a borrower can give his vault to Witch and buy back collateral at a 1:1 rate, avoiding borrowing interest.

- Payout: Audit contest
- Severity: medium
- Program: Yield
- Disclosed: 2021-07-23
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-05-yield-findings/issues/71
- Library page: https://bugbountylibrary.com/r/c4%3A2021-05-yield%3AM-08
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:liquidation

**Target:** Ladle/Witch vault liquidation contracts
**Root cause:** Witch applies a 1:1 underlying/fyToken exchange rate that is wrong after maturity, and buy() does not require the vault to have been grabbed (auction time 0), so collateral sells at art/ink without interest.
**Steps:**
1. Open a borrowing position in a vault; let maturity pass.
2. Repaying with underlying would charge interest (Ladle line 350, rate accrual line 373).
3. Call `Ladle.batch` with operation `GIVE` to hand the vault to `Witch`.
4. Call `Witch.buy(vaultId)` with underlying tokens; `elapsed` (line 61) equals current timestamp since `cauldron.auctions(vaultId)` is 0, so collateral sells at `balances_.art/balances_.ink` (line 74).
5. Buy `balances_.ink` collateral for `balances_.art` underlying, paying no borrowing fee.
**How found:** Code review of Ladle interest accrual vs Witch buy pricing; noticed auctions mapping defaults to 0 for never-grabbed vaults, making elapsed huge and price 1:1.
**Exploitation:** Borrower gives vault to Witch then buys all collateral with underlying at the default 1:1 auction price, closing the position without paying accrued interest.
**Insight:** Check liquidation/auction entrypoints for missing 'was grabbed' guards: default-zero auction timestamps can yield attacker-favorable prices, and post-maturity exchange rates differ from 1:1.