# Single under-funded protocol can break paying off debt

SherXERC20.payOffDebtAll reverts when any single protocol's balance can't cover accrued premium, bricking setTokenPrice, redeem, and other core functions.

- Payout: Audit contest
- Severity: high
- Program: Sherlock
- Found by: cmichel
- Disclosed: 2021-09-16
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-07-sherlock-findings/issues/119
- Library page: https://bugbountylibrary.com/r/c4%3A2021-07-sherlock%3AH-01
- Tags: area:web3 domain:web3 impact:dos kind:contest platform:code4rena sev:high tech:evm tech:solidity vuln:accounting-error vuln:dos

**Target:** SherXERC20 token contract (Solidity)
**Root cause:** payOffDebtAll loops over all protocols and calls _payOffDebt, which does protocolBalance[_protocol].sub(debt); if any protocol's balance is below accrued debt the subtraction underflows and reverts the whole transaction.
**Steps:**
1. Call any function that triggers payOffDebtAll (e.g. setTokenPrice, setProtocolPremium, withdrawProtocolBalance, redeem).
2. payOffDebtAll iterates all protocols of the token.
3. For a protocol with accrued debt > protocolBalance, `ps.protocolBalance[_protocol].sub(debt)` reverts.
4. Entire transaction reverts, blocking the core function for all users.
**How found:** Code review of the debt-iteration loop noticing a SafeMath sub on a per-protocol balance with no guard for insufficient funds, then tracing which core functions depend on payOffDebtAll.
**Exploitation:** A protocol drains its balance via withdrawProtocolBalance (full amount withdrawable at any time) leaving accrued premium unpaid; subsequent calls to payOffDebtAll-dependent functions revert, freezing pricing, premium updates, withdrawals and redemptions until governance removes the protocol's coverage.
**Insight:** When a batch loop over per-account balances uses checked subtraction, one insolvent account bricks the whole batch; check whether any single participant can drain below accrued obligations and whether governance can react before the revert.