# Debt accrual is path-dependant and inaccurate

MochiVault.accrueDebt subtracts only the caller's discounted debt from total debt, making total debt path-dependent and compounding inaccuracy.

- Payout: Audit contest
- Severity: medium
- Program: Mochi
- Found by: cmichel
- Disclosed: 2021-11-23
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-10-mochi-findings/issues/129
- Library page: https://bugbountylibrary.com/r/c4%3A2021-10-mochi%3AM-06
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error

**Target:** MochiVault.accrueDebt debt accounting
**Root cause:** accrueDebt increases total debt by the full index growth but then reduces it only by the calling user's discounted debt, so total debt depends on which user triggers accrual.
**Steps:**
1. Set total debt 2000, user A debt 1000, user B debt 100, debtIndex 1.0→1.1, 10% discount.
2. A calls accrueDebt: debts=2200, discountedDebt=10, debts=2190.
3. B calls accrueDebt instead: debts=2200, discountedDebt=1, debts=2199.
4. Observe next accrual uses different total debt (2190 vs 2199), discrepancy compounds.
**How found:** Code reading of accrueDebt revealed total debt reduced by caller-specific discounted debt rather than all users' discounts; constructed two-user POC to show path dependence.
**Escalation:** Discrepancy compounds over repeated accruals, growing large if a whale always accrues versus a small-debt user.
**Insight:** In shared-pool accounting, any per-caller adjustment applied to a global accumulator makes state path-dependent; check that global totals are reduced by aggregate (weighted-average) values, not the caller's own share.