# Function foreclosureTimeUser returns a shorter user's foreclosure time than expected

RCTreasury.foreclosureTimeUser adds timeLeftOfDeposit to lastRentCalc instead of block.timestamp, double-counting rent and shortening the user's foreclosure time, misjudging card ownership.

- Payout: Audit contest
- Severity: medium
- Program: Reality Cards
- Found by: shw
- Disclosed: 2021-08-02
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2021-06-realitycards-findings/issues/171
- Library page: https://bugbountylibrary.com/r/c4%3A2021-06-realitycards%3AM-17
- Tags: area:web3 domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error

**Target:** RCTreasury smart contract (Solidity)
**Root cause:** timeLeftOfDeposit is computed from depositAbleToWithdraw (deposit minus rent up to now), so it is relative to block.timestamp, but foreclosureTimeWithoutNewCard adds it to user.lastRentCalc, double-counting rent between lastRentCalc and now.
**Steps:**
1. Read RCTreasury.foreclosureTimeUser around lines 668-678.
2. Observe timeLeftOfDeposit = f(depositAbleToWithdraw(_user)) which already deducts rent from lastRentCalc to now.
3. Observe foreclosureTimeWithoutNewCard = timeLeftOfDeposit + user[_user].lastRentCalc (line 672) and same at line 678.
4. When block.timestamp != lastRentCalc, foreclosure time is understated by (block.timestamp - lastRentCalc).
5. Fix: use user[_user].deposit at line 669, or replace lastRentCalc with block.timestamp at lines 672 and 678.
**How found:** Code-reading of the foreclosure math: noticed timeLeftOfDeposit is anchored to now (via depositAbleToWithdraw) but added to lastRentCalc, implying rent is counted twice whenever the two timestamps differ.
**Insight:** When a helper returns a duration relative to now (deposit minus accrued rent), never add it to a stale timestamp; check that the time base of each term in a timestamp sum matches.