# LendingPair.liquidateAccount does not accrue and update cumulativeInterestRate

liquidateAccount skipped accrueAccount, so a self-liquidating underwater borrower avoids paying interest accrued since the last index update.

- Payout: Audit contest
- Severity: high
- Program: Wild Credit
- Found by: cmichel
- Disclosed: 2021-08-17
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-07-wildcredit-findings/issues/122
- Library page: https://bugbountylibrary.com/r/c4%3A2021-07-wildcredit%3AH-02
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** LendingPair.liquidateAccount lending contract function
**Root cause:** liquidateAccount calls _accrueAccountInterest, which uses the stale cumulativeInterestRate instead of accrueAccount, so the borrower's debt is not updated with interest accrued since the last accrual.
**Steps:**
1. Borrow funds so the position becomes underwater.
2. Wait so interest accrues but cumulativeInterestRate is not updated.
3. Call `liquidateAccount` on yourself instead of repaying.
4. Debt is settled using the stale index, skipping interest owed since last accrual.
**How found:** Code reading of liquidateAccount: noticed it calls _accrueAccountInterest rather than accrueAccount, meaning the cumulativeInterestRate is never refreshed before settlement.
**Exploitation:** An underwater borrower self-liquidates via liquidateAccount; because the interest index is not accrued, the debt settled excludes interest accrued since the last update, letting the borrower avoid those interest payments.
**Insight:** In lending protocols, check every state-changing path that settles debt or collateral for a missing global index accrual; self-liquidation is a cheap way to exploit a stale interest index.